Lv Yunlong 8f0534c96a nvme-rdma: Fix a use after free in nvmet_rdma_write_data_done ...

[ Upstream commit abec6561fc4e0fbb19591a0b35676d8c783b5493 ]

In nvmet_rdma_write_data_done, rsp is recoverd by wc->wr_cqe and freed by
nvmet_rdma_release_rsp(). But after that, pr_info() used the freed
chunk's member object and could leak the freed chunk address with
wc->wr_cqe by computing the offset.

Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2021-03-30 14:31:52 +02:00

..

admin-cmd.c

nvmet: set status to 0 in case for invalid nsid

2021-03-04 11:37:50 +01:00

configfs.c

nvmet: fix a memory leak

2020-08-21 17:14:27 -06:00

core.c

nvmet: don't check iosqes,iocqes for discovery controllers

2021-03-25 09:04:07 +01:00

discovery.c

nvmet: introduce flags member in nvmet_fabrics_ops

2020-07-08 16:16:17 +02:00

fabrics-cmd.c

nvmet: add metadata/T10-PI support

2020-05-27 07:12:40 +02:00

fc.c

nvmet-fc: fix missing check for no hostport struct

2020-09-27 09:14:19 +02:00

fcloop.c

treewide: Use fallthrough pseudo-keyword

2020-08-23 17:36:59 -05:00

io-cmd-bdev.c

treewide: Use fallthrough pseudo-keyword

2020-08-23 17:36:59 -05:00

io-cmd-file.c

nvmet: rename nvmet_check_data_len to nvmet_check_transfer_len

2020-05-27 07:12:39 +02:00

Kconfig

nvmet: introduce the passthru Kconfig option

2020-07-29 07:45:21 +02:00

loop.c

nvme-loop: don't put ctrl on nvme_init_ctrl error

2020-10-07 07:56:16 +02:00

Makefile

nvmet: add passthru code to process commands

2020-07-29 07:45:21 +02:00

nvmet.h

nvmet: handle keep-alive timer when kato is modified by a set features cmd

2020-09-27 09:14:19 +02:00

passthru.c

nvmet: don't use BLK_MQ_REQ_NOWAIT for passthru

2020-10-22 15:28:02 +02:00

rdma.c

nvme-rdma: Fix a use after free in nvmet_rdma_write_data_done

2021-03-30 14:31:52 +02:00

tcp.c

nvmet-tcp: fix potential race of tcp socket closing accept_work

2021-03-04 11:37:50 +01:00

trace.c

nvmet: trace: parse Get LBA Status command in detail

2019-08-29 12:55:01 -07:00

trace.h

nvmet: fix a NULL pointer dereference when tracing the flush command

2020-10-27 10:02:50 +01:00