lkml.org 
[lkml]   [2018]   [Dec]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 59/61] nvmet-rdma: fix response use after free
    Date
    4.9-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    [ Upstream commit d7dcdf9d4e15189ecfda24cc87339a3425448d5c ]

    nvmet_rdma_release_rsp() may free the response before using it at error
    flow.

    Fixes: 8407879 ("nvmet-rdma: fix possible bogus dereference under heavy load")
    Signed-off-by: Israel Rukshin <israelr@mellanox.com>
    Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
    Reviewed-by: Max Gurtovoy <maxg@mellanox.com>
    Signed-off-by: Christoph Hellwig <hch@lst.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/nvme/target/rdma.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c
    index 2dfd877974d7..486393fa4f3e 100644
    --- a/drivers/nvme/target/rdma.c
    +++ b/drivers/nvme/target/rdma.c
    @@ -524,6 +524,7 @@ static void nvmet_rdma_send_done(struct ib_cq *cq, struct ib_wc *wc)
    {
    struct nvmet_rdma_rsp *rsp =
    container_of(wc->wr_cqe, struct nvmet_rdma_rsp, send_cqe);
    + struct nvmet_rdma_queue *queue = cq->cq_context;

    nvmet_rdma_release_rsp(rsp);

    @@ -531,7 +532,7 @@ static void nvmet_rdma_send_done(struct ib_cq *cq, struct ib_wc *wc)
    wc->status != IB_WC_WR_FLUSH_ERR)) {
    pr_err("SEND for CQE 0x%p failed with status %s (%d).\n",
    wc->wr_cqe, ib_wc_status_msg(wc->status), wc->status);
    - nvmet_rdma_error_comp(rsp->queue);
    + nvmet_rdma_error_comp(queue);
    }
    }

    --
    2.19.1


    \
     
     \ /
      Last update: 2018-12-20 10:55    [W:3.728 / U:1.672 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site