From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753728AbcHPNRx (ORCPT ); Tue, 16 Aug 2016 09:17:53 -0400 Received: from mail-wm0-f66.google.com ([74.125.82.66]:35915 "EHLO mail-wm0-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753688AbcHPNRu (ORCPT ); Tue, 16 Aug 2016 09:17:50 -0400 Subject: Re: [PATCH] nvmet-rdma: Fix use after free To: =?UTF-8?Q?Vincent_Stehl=c3=a9?= , linux-nvme@lists.infradead.org, linux-rdma@vger.kernel.org References: <1470230393-23671-1-git-send-email-sagi@grimberg.me> <1471353085-6743-1-git-send-email-vincent.stehle@intel.com> Cc: linux-kernel@vger.kernel.org, Christoph Hellwig From: Sagi Grimberg Message-ID: <75d23c63-8ea7-7d76-2b1e-a641e1907e15@grimberg.me> Date: Tue, 16 Aug 2016 16:17:41 +0300 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <1471353085-6743-1-git-send-email-vincent.stehle@intel.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org > Avoid dereferencing the queue pointer in nvmet_rdma_release_queue_work() > after it has been freed by nvmet_rdma_free_queue(). > > Fixes: d8f7750a08968b10 ("nvmet-rdma: Correctly handle RDMA device hot removal") > Signed-off-by: Vincent Stehlé > Cc: Sagi Grimberg > Cc: Christoph Hellwig > --- > drivers/nvme/target/rdma.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c > index b4d6485..5de8d0a 100644 > --- a/drivers/nvme/target/rdma.c > +++ b/drivers/nvme/target/rdma.c > @@ -978,10 +978,11 @@ static void nvmet_rdma_release_queue_work(struct work_struct *w) > container_of(w, struct nvmet_rdma_queue, release_work); > struct rdma_cm_id *cm_id = queue->cm_id; > struct nvmet_rdma_device *dev = queue->dev; > + enum nvmet_rdma_queue_state state = queue->state; > > nvmet_rdma_free_queue(queue); > > - if (queue->state != NVMET_RDMA_IN_DEVICE_REMOVAL) > + if (state != NVMET_RDMA_IN_DEVICE_REMOVAL) > rdma_destroy_id(cm_id); > > kref_put(&dev->ref, nvmet_rdma_free_dev); > Queued for the next round of rc fixes. Thanks Vincent!