diff options
| author | Vincent Stehlé <vincent.stehle@intel.com> | 2016-08-16 15:11:25 +0200 |
|---|---|---|
| committer | Sagi Grimberg <sagi@grimberg.me> | 2016-08-16 15:16:31 +0200 |
| commit | 3256aaef5e9a851f6be47656868020726e102187 (patch) | |
| tree | 8ad23799a51b9f0c61ebea2a02ec8365acbd38b4 /drivers/nvme | |
| parent | nvme-rdma: initialize ret to zero to avoid returning garbage (diff) | |
| download | linux-3256aaef5e9a851f6be47656868020726e102187.tar.xz linux-3256aaef5e9a851f6be47656868020726e102187.zip | |
nvmet-rdma: Fix use after free
Avoid dereferencing the queue pointer in nvmet_rdma_release_queue_work()
after it has been freed by nvmet_rdma_free_queue().
Fixes: d8f7750a08968b10 ("nvmet-rdma: Correctly handle RDMA device hot removal")
Signed-off-by: Vincent Stehlé <vincent.stehle@intel.com>
Cc: Sagi Grimberg <sagi@grimberg.me>
Cc: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Diffstat (limited to 'drivers/nvme')
| -rw-r--r-- | drivers/nvme/target/rdma.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c index b4d648536c3e..5de8d0a0db58 100644 --- a/drivers/nvme/target/rdma.c +++ b/drivers/nvme/target/rdma.c @@ -978,10 +978,11 @@ static void nvmet_rdma_release_queue_work(struct work_struct *w) container_of(w, struct nvmet_rdma_queue, release_work); struct rdma_cm_id *cm_id = queue->cm_id; struct nvmet_rdma_device *dev = queue->dev; + enum nvmet_rdma_queue_state state = queue->state; nvmet_rdma_free_queue(queue); - if (queue->state != NVMET_RDMA_IN_DEVICE_REMOVAL) + if (state != NVMET_RDMA_IN_DEVICE_REMOVAL) rdma_destroy_id(cm_id); kref_put(&dev->ref, nvmet_rdma_free_dev); |