From: James Smart Date: Mon, 14 Aug 2017 18:20:32 +0000 (-0700) Subject: nvmet-fc: correct use after free on list teardown X-Git-Tag: v5.15~10584^2^2~6 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=16a5a480f067f945fd27bf91ffdce3f959b0d4b6;p=platform%2Fkernel%2Flinux-starfive.git nvmet-fc: correct use after free on list teardown Use list_for_each_entry_safe to prevent list handling from referencing next pointers directly after list_del's Signed-off-by: James Smart Signed-off-by: Christoph Hellwig --- diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c index 1b7f252..b200f9a 100644 --- a/drivers/nvme/target/fc.c +++ b/drivers/nvme/target/fc.c @@ -704,7 +704,7 @@ nvmet_fc_delete_target_queue(struct nvmet_fc_tgt_queue *queue) { struct nvmet_fc_tgtport *tgtport = queue->assoc->tgtport; struct nvmet_fc_fcp_iod *fod = queue->fod; - struct nvmet_fc_defer_fcp_req *deferfcp; + struct nvmet_fc_defer_fcp_req *deferfcp, *tempptr; unsigned long flags; int i, writedataactive; bool disconnect; @@ -735,7 +735,8 @@ nvmet_fc_delete_target_queue(struct nvmet_fc_tgt_queue *queue) } /* Cleanup defer'ed IOs in queue */ - list_for_each_entry(deferfcp, &queue->avail_defer_list, req_list) { + list_for_each_entry_safe(deferfcp, tempptr, &queue->avail_defer_list, + req_list) { list_del(&deferfcp->req_list); kfree(deferfcp); }