nvme-rdma: Fix a use after free in nvmet_rdma_write_data_done

Browse source

In nvmet_rdma_write_data_done, rsp is recoverd by wc->wr_cqe and freed by
nvmet_rdma_release_rsp(). But after that, pr_info() used the freed
chunk's member object and could leak the freed chunk address with
wc->wr_cqe by computing the offset.

Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Signed-off-by: Christoph Hellwig <hch@lst.de>

...

This commit is contained in:

Lv Yunlong 2021-03-10 21:44:13 -08:00 • committed by Christoph Hellwig

parent 0ec84df495

commit abec6561fc

1 changed files with 2 additions and 3 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

5

drivers/nvme/target/rdma.c

View file