projects / linux.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 0ec84df) | patch
nvme-rdma: Fix a use after free in nvmet_rdma_write_data_done
authorLv Yunlong <lyl2019@mail.ustc.edu.cn>
Thu, 11 Mar 2021 05:44:13 +0000 (21:44 -0800)
committerChristoph Hellwig <hch@lst.de>
Thu, 11 Mar 2021 10:48:35 +0000 (11:48 +0100)
commitabec6561fc4e0fbb19591a0b35676d8c783b5493
tree45d82d378dcc4a813f3ee416beea0319401f24bdtree | snapshot
parent0ec84df4953bd42c6583a555773f1d4996a061ebcommit | diff
nvme-rdma: Fix a use after free in nvmet_rdma_write_data_done

In nvmet_rdma_write_data_done, rsp is recoverd by wc->wr_cqe and freed by
nvmet_rdma_release_rsp(). But after that, pr_info() used the freed
chunk's member object and could leak the freed chunk address with
wc->wr_cqe by computing the offset.

Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Signed-off-by: Christoph Hellwig <hch@lst.de>
drivers/nvme/target/rdma.c diff | blob | history
ep93xx device tree rework repo: git://git.maquefel.me/linux.git