Skip to contentSkip to conversation

nvmet-rdma: Fix response use after free

PATCH New Israel Rukshin 3 participants 3 messages Dec 5, 2018

Subsystems (2)
NVMe NVMe target
lore
Share & tools
lore

Israel Rukshin

author
#0 lore raw

PATCH v2 1/1 nvmet-rdma: Fix response use after free

nvmet_rdma_release_rsp() may free the response before using it at error flow.

Fixes 8407879 ("nvmet-rdma: fix possible bogus dereference under heavy load")
Signed-off-by Israel Rukshin <israelr at mellanox.com>
Reviewed-by Max Gurtovoy <maxg at mellanox.com>

---

v1->v2: take queue from cq_context like in other completion handlers

---
 drivers/nvme/target/rdma.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/nvme/target/rdma.c +2 -1
index 3f7971d3..583086d 100644
@@ -529,6 +529,7 @@ static void nvmet_rdma_send_done(struct ib_cq *cq, struct ib_wc *wc)
 {
 	struct nvmet_rdma_rsp *rsp =
 		container_of(wc->wr_cqe, struct nvmet_rdma_rsp, send_cqe);
+	struct nvmet_rdma_queue *queue = cq->cq_context;
 
 	nvmet_rdma_release_rsp(rsp);
 

@@ -536,7 +537,7 @@ static void nvmet_rdma_send_done(struct ib_cq *cq, struct ib_wc *wc)
 		     wc->status != IB_WC_WR_FLUSH_ERR)) {
 		pr_err("SEND for CQE 0x%p failed with status %s (%d).\n",
 			wc->wr_cqe, ib_wc_status_msg(wc->status), wc->status);
-		nvmet_rdma_error_comp(rsp->queue);
+		nvmet_rdma_error_comp(queue);
 	}
 }
Signature · 1 line
1.8.3.1
maintainer
#1 lore raw

PATCH v2 1/1 nvmet-rdma: Fix response use after free

Reviewed-by Sagi Grimberg <sagi at grimberg.me>