From: James Smart <jsmart2021@gmail.com>
To: Liang He <windhl@126.com>,
james.smart@broadcom.com, hch@lst.de, sagi@grimberg.me,
kch@nvidia.com, linux-nvme@lists.infradead.org
Subject: Re: [PATCH] nvmet-fc: Fix potential Use-after-free bug in nvmet_fc_delete_target_queue()
Date: Mon, 19 Sep 2022 10:57:05 -0700 [thread overview]
Message-ID: <35339637-846a-2c7d-d414-fa05527a8cf6@gmail.com> (raw)
In-Reply-To: <5c965e81.13d6.183536d5bba.Coremail.windhl@126.com>
On 9/18/2022 6:46 PM, Liang He wrote:
>>
>> kfree(deferfcp);
>>
>> - spin_lock_irqsave(&queue->qlock, flags);
>> + spin_lock_irqsave(q_lock, flags);
>> }
>> spin_unlock_irqrestore(&queue->qlock, flags);
>>
>> --
>> 2.25.1
>
> Sorry, my patch is totally wrong as the 'qlock' is embeded into queue.
> So if queue is freed, the 'qlock' will also be freed.
>
> Now, we can only hope the 'nvmet_fc_tgt_q_put' in lin 941 will never really free the 'queue'.
Did you actually see that occur (line 941 freed the queue) ?
-- james
next prev parent reply other threads:[~2022-09-19 17:57 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-09-16 8:29 [PATCH] nvmet-fc: Fix potential Use-after-free bug in nvmet_fc_delete_target_queue() Liang He
2022-09-16 18:09 ` James Smart
2022-09-19 1:46 ` Liang He
2022-09-19 17:57 ` James Smart [this message]
2022-09-20 12:54 ` Re:Re: [PATCH] " Liang He
2022-09-20 15:53 ` James Smart
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=35339637-846a-2c7d-d414-fa05527a8cf6@gmail.com \
--to=jsmart2021@gmail.com \
--cc=hch@lst.de \
--cc=james.smart@broadcom.com \
--cc=kch@nvidia.com \
--cc=linux-nvme@lists.infradead.org \
--cc=sagi@grimberg.me \
--cc=windhl@126.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox