nvme-rdma: Fix a use after free in nvmet_rdma_write_data_done
authorLv Yunlong <lyl2019@mail.ustc.edu.cn>
Thu, 11 Mar 2021 05:44:13 +0000 (21:44 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 30 Mar 2021 12:31:52 +0000 (14:31 +0200)
commit8f0534c96ac80bb05dfa74897c151f49b37d6663
tree680bdf1e118e2d9e8d6d2bbe6930e4b24c9dd196
parentc7b3f6db97c2c3969564f270d941d12f6ddbc0eb
nvme-rdma: Fix a use after free in nvmet_rdma_write_data_done

[ Upstream commit abec6561fc4e0fbb19591a0b35676d8c783b5493 ]

In nvmet_rdma_write_data_done, rsp is recoverd by wc->wr_cqe and freed by
nvmet_rdma_release_rsp(). But after that, pr_info() used the freed
chunk's member object and could leak the freed chunk address with
wc->wr_cqe by computing the offset.

Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/nvme/target/rdma.c