]> git.baikalelectronics.ru Git - kernel.git/commit
projects / kernel.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 44f37f5) | patch
nvme-rdma: Fix a use after free in nvmet_rdma_write_data_done
authorLv Yunlong <lyl2019@mail.ustc.edu.cn>
Thu, 11 Mar 2021 05:44:13 +0000 (21:44 -0800)
committerChristoph Hellwig <hch@lst.de>
Thu, 11 Mar 2021 10:48:35 +0000 (11:48 +0100)
commite630b87225553dfd529587d79d15baecac596d5f
tree45d82d378dcc4a813f3ee416beea0319401f24bdtree | snapshot
parent44f37f5e01f687d4a2881891591f7cfbd454f01bcommit | diff
nvme-rdma: Fix a use after free in nvmet_rdma_write_data_done

In nvmet_rdma_write_data_done, rsp is recoverd by wc->wr_cqe and freed by
nvmet_rdma_release_rsp(). But after that, pr_info() used the freed
chunk's member object and could leak the freed chunk address with
wc->wr_cqe by computing the offset.

Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Signed-off-by: Christoph Hellwig <hch@lst.de>
drivers/nvme/target/rdma.c diff | blob | history
Linux Kernel Source Tree.