From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794061517; b=Nk1TqHPvLhSpkOOK8TOybfpUNtzwnXr05PnCiCavysesjftiWGE6CmVKnljJYIbUWHIC FWtvZ6aRiuYPbGBD3tn+FPXWbRnk2wAiJIIXoN7PILpRYGXmRcWbUjZRi8hptQ2eO2XxE EwmGzwM8/IEfKplNdwYM3HnyLvKZmQED694+iAkW5avdMj9m22nVhb9sWViGIvVA6IveP /ljX2/WD400QFfILx97Z3tV8XSDcmuofsCHcdiWWcAPgogGh/G9oDMwbVJhsU1EVv4VGu r9xznofjv/D3Tt2L7bCjLQCxOzrub/rd3trMEOdEQT3wPDrYVy05DUYCOtf6veRRlaw== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794061517; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=gAOJ8mSWD4pHm0kIcCr08Q4MkqbDln9fe2EzYG39K3A=; b=2c7DqqMn3Xh+KBK+LvCF+CgV1qRtg6Lf+0KoKEZN1HTWSrCYC0DNZDGIVKZ00+ULyDm6 aCcXFBtue5VnhPYNEwZ5Jh18Su2RODGXb/yg8RUQngb6qY7BRLotPdI1W2h6L5ilMgXoi D3yje+lVEa6gXT/mpOezyEeda1V2QjvEDAphEFsGQ0nWyLFz99QHDPDQs8QRkPEjfKLPu u6+QnPnpIBw3oxP/v5xBUH7a3aOg4+BOm88Iqwcu9Uh8P8PysyaS291x+jPD+q0opGGr9 mzPjekqkC0Yy1xyWikX6anMFG2fuWxuIMc4MhSZfvdbiKvHTNER5viCAfO1f+PmoFTA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=McvihWSE; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 61491606A32C; Sat, 7 Nov 2026 14:25:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=McvihWSE Received: by smtp.kernel.org (Postfix) with ESMTPSA id 16CAF1F008A1; Sat, 7 Nov 2026 14:25:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794061517; bh=gAOJ8mSWD4pHm0kIcCr08Q4MkqbDln9fe2EzYG39K3A=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=McvihWSEYNww2TnY+hfB3lKCbYwraA3ai/1wqYGYpRTN6m3CBSPKlU88aAMA8Usly bNu9Ku3XJF90Q4Gc2q5NW6txOuYlc6kCGHJxDOvyHOqt0epdjm9qELRlkOhcw5coGm use/WfrWfGpJq0hOGUA2XGm3FICXlYMDE9RUU5fw= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Shuangpeng Bai , Yehyeong Lee , Keith Busch Subject: [PATCH 6.12 0607/1536] nvmet-fc: fix use-after-free in nvmet_fc_ls_create_connection() Date: Sat, 7 Nov 2026 08:43:43 -0500 Message-ID: <20261107135014.589809709@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261107134957.653319350@linuxfoundation.org> References: <20261107134957.653319350@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Yehyeong Lee commit 2c29f8c9b9e598c09fa50aa02200136a107f6b3f upstream. nvmet_fc_ls_create_connection() looks up the association with nvmet_fc_find_target_assoc(), which returns it with a reference held, and drops that reference as soon as the target queue has been allocated. iod->assoc is then dereferenced again by nvmet_fc_makeconnid() while building the connection id. The queue only borrows the pointer and takes no reference of its own. Once the lookup reference is dropped the association is kept alive solely by the reference taken when it was created, so a disconnect LS or a remote port unregister running concurrently can free it before nvmet_fc_makeconnid() reads it: BUG: KASAN: slab-use-after-free in nvmet_fc_handle_ls_rqst_work (drivers/nvme/target/fc.c:193 drivers/nvme/target/fc.c:1841 drivers/nvme/target/fc.c:1995 drivers/nvme/target/fc.c:2021) Read of size 8 at addr ffff888179f1b000 by task kworker/u9:2/1167 Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Workqueue: nvmet-wq nvmet_fc_handle_ls_rqst_work Call Trace: dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120) print_report (mm/kasan/report.c:378 mm/kasan/report.c:482) kasan_report (mm/kasan/report.c:595) nvmet_fc_handle_ls_rqst_work (drivers/nvme/target/fc.c:193 drivers/nvme/target/fc.c:1841 drivers/nvme/target/fc.c:1995 drivers/nvme/target/fc.c:2021) process_scheduled_works (kernel/workqueue.c:3322 kernel/workqueue.c:3405) worker_thread (kernel/workqueue.c:3486) kthread (kernel/kthread.c:436) ret_from_fork (archkernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245) Freed by task 1167 on cpu 0 at 405.998150s: kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78) kasan_save_free_info (mm/kasan/generic.c:584) __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285) kfree (include/linux/kasan.h:235 mm/slub.c:2705 mm/slub.c:6405 mm/slub.c:6720) nvmet_fc_handle_ls_rqst_work (drivers/nvme/target/fc.c:1808 drivers/nvme/target/fc.c:1995 drivers/nvme/target/fc.c:2021) process_scheduled_works (kernel/workqueue.c:3322 kernel/workqueue.c:3405) worker_thread (kernel/workqueue.c:3486) kthread (kernel/kthread.c:436) ret_from_fork (archkernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245) The buggy address belongs to the object at ffff888179f1b000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 0 bytes inside of freed 2048-byte region [ffff888179f1b000, ffff888179f1b800) Hold the lookup reference until the response has been built, and drop it on the error path as well. Reported-by: Shuangpeng Bai Closes: https://lore.kernel.org/linux-nvme/20260731204504.2396434-1-shuangpeng.kernel@gmail.com Fixes: c53432030d86 ("nvme-fabrics: Add target support for FC transport") Cc: stable@vger.kernel.org Signed-off-by: Yehyeong Lee Signed-off-by: Keith Busch Signed-off-by: Greg Kroah-Hartman --- drivers/nvme/target/fc.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) --- a/drivers/nvme/target/fc.c +++ b/drivers/nvme/target/fc.c @@ -1777,9 +1777,6 @@ nvmet_fc_ls_create_connection(struct nvm be16_to_cpu(rqst->connect_cmd.sqsize)); if (!queue) ret = VERR_QUEUE_ALLOC_FAIL; - - /* release get taken in nvmet_fc_find_target_assoc */ - nvmet_fc_tgt_a_put(iod->assoc); } } @@ -1793,6 +1790,8 @@ nvmet_fc_ls_create_connection(struct nvm FCNVME_RJT_RC_INV_ASSOC : FCNVME_RJT_RC_LOGIC, FCNVME_RJT_EXP_NONE, 0); + if (iod->assoc) + nvmet_fc_tgt_a_put(iod->assoc); return; } @@ -1814,6 +1813,9 @@ nvmet_fc_ls_create_connection(struct nvm acc->connectid.connection_id = cpu_to_be64(nvmet_fc_makeconnid(iod->assoc, be16_to_cpu(rqst->connect_cmd.qid))); + + /* release get taken in nvmet_fc_find_target_assoc */ + nvmet_fc_tgt_a_put(iod->assoc); } /*