Messages in this thread | | | Date | Mon, 17 Aug 2015 23:26:34 +0200 | From | Sebastian Herbszt <> | Subject | Re: [PATCH] lpfc: Fix possible use-after-free and double free in lpfc_mbx_cmpl_rdp_page_a2() |
| |
Johannes Thumshirn wrote: > If the bf_get() call in lpfc_mbx_cmpl_rdp_page_a2() does succeeds, execution > continues normally and mp gets kfree()d. > > If the subsequent call to lpfc_sli_issue_mbox() fails execution jumps to the > error label where lpfc_mbuf_free() is called with mp->virt and mp->phys as > function arguments. This is the use after free. Following the use after free mp > gets kfree()d again which is a double free.
A similar patch was posted by Colin Ian King on 2015-07-31 [1].
[1] http://marc.info/?l=linux-scsi&m=143835937206204&w=2
Sebastian
| |