From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Israel Rukshin <israelr@mellanox.com>,
Christoph Hellwig <hch@lst.de>, Sasha Levin <sashal@kernel.org>,
linux-nvme@lists.infradead.org
Subject: [PATCH AUTOSEL 4.9 33/34] nvmet-rdma: fix response use after free
Date: Wed, 12 Dec 2018 23:31:59 -0500 [thread overview]
Message-ID: <20181213043200.76295-33-sashal@kernel.org> (raw)
In-Reply-To: <20181213043200.76295-1-sashal@kernel.org>
From: Israel Rukshin <israelr@mellanox.com>
[ Upstream commit d7dcdf9d4e15189ecfda24cc87339a3425448d5c ]
nvmet_rdma_release_rsp() may free the response before using it at error
flow.
Fixes: 8407879 ("nvmet-rdma: fix possible bogus dereference under heavy load")
Signed-off-by: Israel Rukshin <israelr@mellanox.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Max Gurtovoy <maxg@mellanox.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/target/rdma.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c
index 2dfd877974d7..486393fa4f3e 100644
--- a/drivers/nvme/target/rdma.c
+++ b/drivers/nvme/target/rdma.c
@@ -524,6 +524,7 @@ static void nvmet_rdma_send_done(struct ib_cq *cq, struct ib_wc *wc)
{
struct nvmet_rdma_rsp *rsp =
container_of(wc->wr_cqe, struct nvmet_rdma_rsp, send_cqe);
+ struct nvmet_rdma_queue *queue = cq->cq_context;
nvmet_rdma_release_rsp(rsp);
@@ -531,7 +532,7 @@ static void nvmet_rdma_send_done(struct ib_cq *cq, struct ib_wc *wc)
wc->status != IB_WC_WR_FLUSH_ERR)) {
pr_err("SEND for CQE 0x%p failed with status %s (%d).\n",
wc->wr_cqe, ib_wc_status_msg(wc->status), wc->status);
- nvmet_rdma_error_comp(rsp->queue);
+ nvmet_rdma_error_comp(queue);
}
}
--
2.19.1
next prev parent reply other threads:[~2018-12-13 4:31 UTC|newest]
Thread overview: 35+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-12-13 4:31 [PATCH AUTOSEL 4.9 01/34] mac80211_hwsim: fix module init error paths for netlink Sasha Levin
2018-12-13 4:31 ` [PATCH AUTOSEL 4.9 02/34] scsi: libiscsi: Fix NULL pointer dereference in iscsi_eh_session_reset Sasha Levin
2018-12-13 4:31 ` [PATCH AUTOSEL 4.9 03/34] scsi: vmw_pscsi: Rearrange code to avoid multiple calls to free_irq during unload Sasha Levin
2018-12-13 4:31 ` [PATCH AUTOSEL 4.9 04/34] x86/earlyprintk/efi: Fix infinite loop on some screen widths Sasha Levin
2018-12-13 4:31 ` [PATCH AUTOSEL 4.9 05/34] drm/msm: Grab a vblank reference when waiting for commit_done Sasha Levin
2018-12-13 4:31 ` [PATCH AUTOSEL 4.9 06/34] ARC: io.h: Implement reads{x}()/writes{x}() Sasha Levin
2018-12-13 4:31 ` [PATCH AUTOSEL 4.9 07/34] bonding: fix 802.3ad state sent to partner when unbinding slave Sasha Levin
2018-12-13 4:31 ` [PATCH AUTOSEL 4.9 08/34] nfs: don't dirty kernel pages read by direct-io Sasha Levin
2018-12-13 4:31 ` [PATCH AUTOSEL 4.9 09/34] SUNRPC: Fix leak of krb5p encode pages Sasha Levin
2018-12-13 4:31 ` [PATCH AUTOSEL 4.9 10/34] SUNRPC: Fix a potential race in xprt_connect() Sasha Levin
2018-12-13 4:31 ` [PATCH AUTOSEL 4.9 11/34] sbus: char: add of_node_put() Sasha Levin
2018-12-13 4:31 ` [PATCH AUTOSEL 4.9 12/34] drivers/sbus/char: " Sasha Levin
2018-12-13 4:31 ` [PATCH AUTOSEL 4.9 13/34] drivers/tty: add missing of_node_put() Sasha Levin
2018-12-13 4:31 ` [PATCH AUTOSEL 4.9 14/34] ide: pmac: add of_node_put() Sasha Levin
2018-12-13 4:31 ` [PATCH AUTOSEL 4.9 15/34] clk: mvebu: Off by one bugs in cp110_of_clk_get() Sasha Levin
2018-12-13 4:31 ` [PATCH AUTOSEL 4.9 16/34] clk: mmp: Off by one in mmp_clk_add() Sasha Levin
2018-12-13 4:31 ` [PATCH AUTOSEL 4.9 17/34] Input: omap-keypad - fix keyboard debounce configuration Sasha Levin
2018-12-13 4:31 ` [PATCH AUTOSEL 4.9 18/34] libata: whitelist all SAMSUNG MZ7KM* solid-state disks Sasha Levin
2018-12-13 4:31 ` [PATCH AUTOSEL 4.9 19/34] net: phy: don't allow __set_phy_supported to add unsupported modes Sasha Levin
2018-12-13 4:31 ` [PATCH AUTOSEL 4.9 20/34] net: 8139cp: fix a BUG triggered by changing mtu with network traffic Sasha Levin
2018-12-13 4:31 ` [PATCH AUTOSEL 4.9 21/34] net: phy: Fix not to call phy_resume() if PHY is not attached Sasha Levin
2018-12-13 4:50 ` Yoshihiro Shimoda
2018-12-13 4:31 ` [PATCH AUTOSEL 4.9 22/34] mv88e6060: disable hardware level MAC learning Sasha Levin
2018-12-13 4:31 ` [PATCH AUTOSEL 4.9 23/34] net/mlx4_en: Fix build break when CONFIG_INET is off Sasha Levin
2018-12-13 4:31 ` [PATCH AUTOSEL 4.9 24/34] bpf: check pending signals while verifying programs Sasha Levin
2018-12-13 4:31 ` [PATCH AUTOSEL 4.9 25/34] ARM: 8814/1: mm: improve/fix ARM v7_dma_inv_range() unaligned address handling Sasha Levin
2018-12-13 4:31 ` [PATCH AUTOSEL 4.9 26/34] ARM: 8815/1: V7M: align v7m_dma_inv_range() with v7 counterpart Sasha Levin
2018-12-13 4:31 ` [PATCH AUTOSEL 4.9 27/34] ethernet: fman: fix wrong of_node_put() in probe function Sasha Levin
2018-12-13 4:31 ` [PATCH AUTOSEL 4.9 28/34] drm/ast: Fix connector leak during driver unload Sasha Levin
2018-12-13 4:31 ` [PATCH AUTOSEL 4.9 29/34] cifs: In Kconfig CONFIG_CIFS_POSIX needs depends on legacy (insecure cifs) Sasha Levin
2018-12-13 4:31 ` [PATCH AUTOSEL 4.9 30/34] vhost/vsock: fix reset orphans race with close timeout Sasha Levin
2018-12-13 4:31 ` [PATCH AUTOSEL 4.9 31/34] i2c: axxia: properly handle master timeout Sasha Levin
2018-12-13 4:31 ` [PATCH AUTOSEL 4.9 32/34] i2c: scmi: Fix probe error on devices with an empty SMB0001 ACPI device node Sasha Levin
2018-12-13 4:31 ` Sasha Levin [this message]
2018-12-13 4:32 ` [PATCH AUTOSEL 4.9 34/34] net/mlx4_core: Correctly set PFC param if global pause is turned off Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181213043200.76295-33-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=hch@lst.de \
--cc=israelr@mellanox.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-nvme@lists.infradead.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).