]> git.baikalelectronics.ru Git - kernel.git/commit
projects / kernel.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 963bcfd) | patch
nvme-rdma: Fix a use after free in nvmet_rdma_write_data_done
authorLv Yunlong <lyl2019@mail.ustc.edu.cn>
Thu, 11 Mar 2021 05:44:13 +0000 (21:44 -0800)
committerChristoph Hellwig <hch@lst.de>
Thu, 11 Mar 2021 10:48:35 +0000 (11:48 +0100)
commit43d8b6db071c9b38ceb5e569c25c935b1db1e9ad
tree45d82d378dcc4a813f3ee416beea0319401f24bdtree | snapshot
parent963bcfd23ccce420318d8fb659a51aa6dd6b03a7commit | diff
nvme-rdma: Fix a use after free in nvmet_rdma_write_data_done

In nvmet_rdma_write_data_done, rsp is recoverd by wc->wr_cqe and freed by
nvmet_rdma_release_rsp(). But after that, pr_info() used the freed
chunk's member object and could leak the freed chunk address with
wc->wr_cqe by computing the offset.

Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Signed-off-by: Christoph Hellwig <hch@lst.de>
drivers/nvme/target/rdma.c diff | blob | history
Linux Kernel Source Tree.