From: Sebastian Herbszt <herbszt@gmx.de>
To: Johannes Thumshirn <jthumshirn@suse.de>
Cc: James Smart <james.smart@avagotech.com>,
Dick Kennedy <dick.kennedy@avagotech.com>,
"James E.J. Bottomley" <JBottomley@odin.com>,
linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org,
Colin King <colin.king@canonical.com>,
Sebastian Herbszt <herbszt@gmx.de>
Subject: Re: [PATCH] lpfc: Fix possible use-after-free and double free in lpfc_mbx_cmpl_rdp_page_a2()
Date: Mon, 17 Aug 2015 23:26:34 +0200 [thread overview]
Message-ID: <20150817232634.00006d80@localhost> (raw)
In-Reply-To: <1439809382-32419-1-git-send-email-jthumshirn@suse.de>
Johannes Thumshirn wrote:
> If the bf_get() call in lpfc_mbx_cmpl_rdp_page_a2() does succeeds, execution
> continues normally and mp gets kfree()d.
>
> If the subsequent call to lpfc_sli_issue_mbox() fails execution jumps to the
> error label where lpfc_mbuf_free() is called with mp->virt and mp->phys as
> function arguments. This is the use after free. Following the use after free mp
> gets kfree()d again which is a double free.
A similar patch was posted by Colin Ian King on 2015-07-31 [1].
[1] http://marc.info/?l=linux-scsi&m=143835937206204&w=2
Sebastian
next prev parent reply other threads:[~2015-08-17 21:26 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-08-17 11:03 [PATCH] lpfc: Fix possible use-after-free and double free in lpfc_mbx_cmpl_rdp_page_a2() Johannes Thumshirn
2015-08-17 21:26 ` Sebastian Herbszt [this message]
2015-08-18 6:36 ` Johannes Thumshirn
2015-08-18 22:27 ` Sebastian Herbszt
2015-08-31 20:53 ` James Smart
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20150817232634.00006d80@localhost \
--to=herbszt@gmx.de \
--cc=JBottomley@odin.com \
--cc=colin.king@canonical.com \
--cc=dick.kennedy@avagotech.com \
--cc=james.smart@avagotech.com \
--cc=jthumshirn@suse.de \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-scsi@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.