nvmet: avoid potential UAF in nvmet_req_complete()
[ Upstream commit6173a77b7e
] An nvme target ->queue_response() operation implementation may free the request passed as argument. Such implementation potentially could result in a use after free of the request pointer when percpu_ref_put() is called in nvmet_req_complete(). Avoid such problem by using a local variable to save the sq pointer before calling __nvmet_req_complete(), thus avoiding dereferencing the req pointer after that function call. Fixes:a07b4970f4
("nvmet: add a generic NVMe target") Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com> Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com> Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
4a4de0a68b
commit
e5d99b2901
|
@ -418,8 +418,10 @@ static void __nvmet_req_complete(struct nvmet_req *req, u16 status)
|
|||
|
||||
void nvmet_req_complete(struct nvmet_req *req, u16 status)
|
||||
{
|
||||
struct nvmet_sq *sq = req->sq;
|
||||
|
||||
__nvmet_req_complete(req, status);
|
||||
percpu_ref_put(&req->sq->ref);
|
||||
percpu_ref_put(&sq->ref);
|
||||
}
|
||||
EXPORT_SYMBOL_GPL(nvmet_req_complete);
|
||||
|
||||
|
|
Loading…
Reference in New Issue