Searched hist:abec6561fc4e0fbb19591a0b35676d8c783b5493 (Results 1 – 1 of 1) sorted by relevance
| /openbmc/linux/drivers/nvme/target/ |
| H A D | rdma.c | diff abec6561fc4e0fbb19591a0b35676d8c783b5493 Wed Mar 10 23:44:13 CST 2021 Lv Yunlong <lyl2019@mail.ustc.edu.cn> nvme-rdma: Fix a use after free in nvmet_rdma_write_data_done
In nvmet_rdma_write_data_done, rsp is recoverd by wc->wr_cqe and freed by
nvmet_rdma_release_rsp(). But after that, pr_info() used the freed
chunk's member object and could leak the freed chunk address with
wc->wr_cqe by computing the offset.
Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Signed-off-by: Christoph Hellwig <hch@lst.de>
|