Linux-NVME Archive on lore.kernel.org
 help / color / mirror / Atom feed
From: Rihyeon Kim <rihyeon8648@gmail.com>
To: kbusch@kernel.org
Cc: hch@lst.de, sagi@grimberg.me, axboe@kernel.dk,
	justin.tee@broadcom.com, nareshgottumukkala83@gmail.com,
	paul.ely@broadcom.com, kch@nvidia.com,
	linux-nvme@lists.infradead.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails
Date: Wed, 12 Aug 2026 19:55:04 +0900	[thread overview]
Message-ID: <20260812105504.53711-1-rihyeon8648@gmail.com> (raw)
In-Reply-To: <ans_4i0GcU2YAkKl@kbusch-mbp>

Hello,

Thanks for the review.

> Can't you move the setting from the "fail_ctrl:" label to the
> "out_put_ctrl:" one instead of duplicating it for both?

Yes.  I had kept both because I was not sure the put inside
nvme_uninit_ctrl() could not be the last one, which would run
nvme_fc_ctrl_free() before out_put_ctrl: cleared the pointer.  As far as
I could tell nvme-tcp and nvme-rdma use the same uninit-then-put ladder,
and testing does not show it either.

I swept fail-nth 1..200 over the connect write with fcloop and failslab:
unpatched hits the report at 17, and with the clear moved all 200 pass,
21 of the injections landing in nvme_alloc_admin_tag_set(), so fail_ctrl:
is covered as well.

It also looks like moving it drops the window where opts is already NULL
while the fabrics sysfs attributes, which do not check it, are still
there.

v2 on the way.

Thanks,
Rihyeon


  reply	other threads:[~2026-08-12 10:55 UTC|newest]

Thread overview: 22+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-08-11  2:06 [syzbot] [nvme?] KASAN: slab-use-after-free Read in nvmf_free_options syzbot
2026-08-11 12:53 ` [PATCH] nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails Rihyeon Kim
2026-08-11 13:10   ` Niklas Cassel
2026-08-12 10:55     ` Rihyeon Kim
2026-08-12 10:59     ` Rihyeon Kim
2026-08-12 14:26       ` Niklas Cassel
2026-08-12 14:30         ` Niklas Cassel
2026-08-11 15:29   ` Keith Busch
2026-08-12 10:55     ` Rihyeon Kim [this message]
2026-08-12 10:59     ` Rihyeon Kim
  -- strict thread matches above, loose matches on Subject: below --
2026-08-14 14:38 Niklas Cassel
2026-08-14 16:30 ` Keith Busch
2026-08-17  6:18 ` Rihyeon Kim
2026-08-17 15:10   ` Niklas Cassel
2026-08-19 15:28     ` Keith Busch
2026-08-19 18:32       ` Niklas Cassel
2026-08-20 15:23         ` Keith Busch
2026-08-21 13:21           ` Niklas Cassel
2026-08-21 14:18             ` Keith Busch
2026-08-21 14:35               ` Keith Busch
2026-08-21 14:56               ` Niklas Cassel
2026-08-25 17:45 ` Hannes Reinecke

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260812105504.53711-1-rihyeon8648@gmail.com \
    --to=rihyeon8648@gmail.com \
    --cc=axboe@kernel.dk \
    --cc=hch@lst.de \
    --cc=justin.tee@broadcom.com \
    --cc=kbusch@kernel.org \
    --cc=kch@nvidia.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-nvme@lists.infradead.org \
    --cc=nareshgottumukkala83@gmail.com \
    --cc=paul.ely@broadcom.com \
    --cc=sagi@grimberg.me \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox