nvmet-rdma: fix use-after-free when a port is removed
authorIsrael Rukshin <israelr@nvidia.com>
Wed, 6 Oct 2021 08:09:44 +0000 (08:09 +0000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 18 Nov 2021 18:16:18 +0000 (19:16 +0100)
commit3c82292ee9bc0d3144d03ed0f96344ebf9e27453
treecf0e2bd1c9052706fd84c3ec3111ff95ef6cd60e
parente3d5ebee9c058ccb46a4ae161998a106397980c9
nvmet-rdma: fix use-after-free when a port is removed

[ Upstream commit fcf73a804c7d6bbf0ea63531c6122aa363852e04 ]

When removing a port, all its controllers are being removed, but there
are queues on the port that doesn't belong to any controller (during
connection time). This causes a use-after-free bug for any command
that dereferences req->port (like in nvmet_alloc_ctrl). Those queues
should be destroyed before freeing the port via configfs. Destroy the
remaining queues after the RDMA-CM was destroyed guarantees that no
new queue will be created.

Signed-off-by: Israel Rukshin <israelr@nvidia.com>
Reviewed-by: Max Gurtovoy <mgurtovoy@nvidia.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/nvme/target/rdma.c