leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nvmet-fc: correct use after free on list teardown

Browse Source 
Use list_for_each_entry_safe to prevent list handling from referencing
next pointers directly after list_del's

Signed-off-by: James Smart <james.smart@broadcom.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
This commit is contained in:
James Smart 2017-08-14 11:20:32 -07:00 committed by Christoph Hellwig
parent 42819eb7a0
commit 16a5a480f0
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/nvme/target/fc.c
View File

@ -704,7 +704,7 @@ nvmet_fc_delete_target_queue(struct nvmet_fc_tgt_queue *queue)
{ {
struct nvmet_fc_tgtport *tgtport = queue->assoc->tgtport; struct nvmet_fc_tgtport *tgtport = queue->assoc->tgtport;
struct nvmet_fc_fcp_iod *fod = queue->fod; struct nvmet_fc_fcp_iod *fod = queue->fod;
struct nvmet_fc_defer_fcp_req *deferfcp; struct nvmet_fc_defer_fcp_req *deferfcp, *tempptr;
unsigned long flags; unsigned long flags;
int i, writedataactive; int i, writedataactive;
bool disconnect; bool disconnect;
@ -735,7 +735,8 @@ nvmet_fc_delete_target_queue(struct nvmet_fc_tgt_queue *queue)
} }
/* Cleanup defer'ed IOs in queue */ /* Cleanup defer'ed IOs in queue */
list_for_each_entry(deferfcp, &queue->avail_defer_list, req_list) { list_for_each_entry_safe(deferfcp, tempptr, &queue->avail_defer_list,
req_list) {
list_del(&deferfcp->req_list); list_del(&deferfcp->req_list);
kfree(deferfcp); kfree(deferfcp);
} }