* [PATCH] nvmet-rdma: Fix use after free [not found] <1470230393-23671-1-git-send-email-sagi@grimberg.me> @ 2016-08-16 13:11 ` Vincent Stehlé 2016-08-16 13:17 ` Sagi Grimberg 0 siblings, 1 reply; 2+ messages in thread From: Vincent Stehlé @ 2016-08-16 13:11 UTC (permalink / raw) To: linux-nvme, linux-rdma Cc: linux-kernel, Vincent Stehlé, Sagi Grimberg, Christoph Hellwig Avoid dereferencing the queue pointer in nvmet_rdma_release_queue_work() after it has been freed by nvmet_rdma_free_queue(). Fixes: d8f7750a08968b10 ("nvmet-rdma: Correctly handle RDMA device hot removal") Signed-off-by: Vincent Stehlé <vincent.stehle@intel.com> Cc: Sagi Grimberg <sagi@grimberg.me> Cc: Christoph Hellwig <hch@lst.de> --- drivers/nvme/target/rdma.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c index b4d6485..5de8d0a 100644 --- a/drivers/nvme/target/rdma.c +++ b/drivers/nvme/target/rdma.c @@ -978,10 +978,11 @@ static void nvmet_rdma_release_queue_work(struct work_struct *w) container_of(w, struct nvmet_rdma_queue, release_work); struct rdma_cm_id *cm_id = queue->cm_id; struct nvmet_rdma_device *dev = queue->dev; + enum nvmet_rdma_queue_state state = queue->state; nvmet_rdma_free_queue(queue); - if (queue->state != NVMET_RDMA_IN_DEVICE_REMOVAL) + if (state != NVMET_RDMA_IN_DEVICE_REMOVAL) rdma_destroy_id(cm_id); kref_put(&dev->ref, nvmet_rdma_free_dev); -- 2.8.1 ^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCH] nvmet-rdma: Fix use after free 2016-08-16 13:11 ` [PATCH] nvmet-rdma: Fix use after free Vincent Stehlé @ 2016-08-16 13:17 ` Sagi Grimberg 0 siblings, 0 replies; 2+ messages in thread From: Sagi Grimberg @ 2016-08-16 13:17 UTC (permalink / raw) To: Vincent Stehlé, linux-nvme, linux-rdma Cc: linux-kernel, Christoph Hellwig > Avoid dereferencing the queue pointer in nvmet_rdma_release_queue_work() > after it has been freed by nvmet_rdma_free_queue(). > > Fixes: d8f7750a08968b10 ("nvmet-rdma: Correctly handle RDMA device hot removal") > Signed-off-by: Vincent Stehlé <vincent.stehle@intel.com> > Cc: Sagi Grimberg <sagi@grimberg.me> > Cc: Christoph Hellwig <hch@lst.de> > --- > drivers/nvme/target/rdma.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c > index b4d6485..5de8d0a 100644 > --- a/drivers/nvme/target/rdma.c > +++ b/drivers/nvme/target/rdma.c > @@ -978,10 +978,11 @@ static void nvmet_rdma_release_queue_work(struct work_struct *w) > container_of(w, struct nvmet_rdma_queue, release_work); > struct rdma_cm_id *cm_id = queue->cm_id; > struct nvmet_rdma_device *dev = queue->dev; > + enum nvmet_rdma_queue_state state = queue->state; > > nvmet_rdma_free_queue(queue); > > - if (queue->state != NVMET_RDMA_IN_DEVICE_REMOVAL) > + if (state != NVMET_RDMA_IN_DEVICE_REMOVAL) > rdma_destroy_id(cm_id); > > kref_put(&dev->ref, nvmet_rdma_free_dev); > Queued for the next round of rc fixes. Thanks Vincent! ^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2016-08-16 13:17 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <1470230393-23671-1-git-send-email-sagi@grimberg.me>
2016-08-16 13:11 ` [PATCH] nvmet-rdma: Fix use after free Vincent Stehlé
2016-08-16 13:17 ` Sagi Grimberg
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®