From: "Liang He" <windhl@126.com>
To: "James Smart" <jsmart2021@gmail.com>
Cc: james.smart@broadcom.com, hch@lst.de, sagi@grimberg.me,
kch@nvidia.com, linux-nvme@lists.infradead.org
Subject: Re:Re: [PATCH] nvmet-fc: Fix potential Use-after-free bug in nvmet_fc_delete_target_queue()
Date: Tue, 20 Sep 2022 20:54:10 +0800 (CST) [thread overview]
Message-ID: <71e21f4.78db.1835af68bbc.Coremail.windhl@126.com> (raw)
In-Reply-To: <35339637-846a-2c7d-d414-fa05527a8cf6@gmail.com>
At 2022-09-20 01:57:05, "James Smart" <jsmart2021@gmail.com> wrote:
>On 9/18/2022 6:46 PM, Liang He wrote:
>>>
>>> kfree(deferfcp);
>>>
>>> - spin_lock_irqsave(&queue->qlock, flags);
>>> + spin_lock_irqsave(q_lock, flags);
>>> }
>>> spin_unlock_irqrestore(&queue->qlock, flags);
>>>
>>> --
>>> 2.25.1
>>
>> Sorry, my patch is totally wrong as the 'qlock' is embeded into queue.
>> So if queue is freed, the 'qlock' will also be freed.
>>
>> Now, we can only hope the 'nvmet_fc_tgt_q_put' in lin 941 will never really free the 'queue'.
>
>Did you actually see that occur (line 941 freed the queue) ?
>
>-- james
Hi, James,
I actually have not seen this as I use static method to detect it.
While there will be no UAF in current version, I think we should not use the
reference after we put it, right?
Liang
next prev parent reply other threads:[~2022-09-20 12:59 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-09-16 8:29 [PATCH] nvmet-fc: Fix potential Use-after-free bug in nvmet_fc_delete_target_queue() Liang He
2022-09-16 18:09 ` James Smart
2022-09-19 1:46 ` Liang He
2022-09-19 17:57 ` [PATCH] " James Smart
2022-09-20 12:54 ` Liang He [this message]
2022-09-20 15:53 ` James Smart
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=71e21f4.78db.1835af68bbc.Coremail.windhl@126.com \
--to=windhl@126.com \
--cc=hch@lst.de \
--cc=james.smart@broadcom.com \
--cc=jsmart2021@gmail.com \
--cc=kch@nvidia.com \
--cc=linux-nvme@lists.infradead.org \
--cc=sagi@grimberg.me \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox