summaryrefslogtreecommitdiffstats
path: root/drivers/scsi/lpfc/lpfc_nvmet.c
diff options
context:
space:
mode:
authorJames Smart <jsmart2021@gmail.com>2019-05-22 02:48:59 +0200
committerMartin K. Petersen <martin.petersen@oracle.com>2019-06-19 01:46:21 +0200
commit51d23fb28ccb355ee4d26dedacca24c171c2f664 (patch)
tree244cede07ab0daea39724fc51adfa1cd3583abdd /drivers/scsi/lpfc/lpfc_nvmet.c
parentscsi: lpfc: Fix PT2PT PLOGI collison stopping discovery (diff)
downloadlinux-51d23fb28ccb355ee4d26dedacca24c171c2f664.tar.xz
linux-51d23fb28ccb355ee4d26dedacca24c171c2f664.zip
scsi: lpfc: Prevent 'use after free' memory overwrite in nvmet LS handling
Use-after-free memory overwrite detected. Problem reported by Ewan Milne at Red Hat after running lpfc target with additional memory checking enabled. Race condition when lpfc_nvmet_xmt_ls_rsp_cmp frees the ctxp memory in interrupt context before lpfc_nvmet_xmt_ls_rsp clears a field in the ctxp after successfully issuing the wqe. Remove the unnecessary ctxp write after reposting the rq buffer. The ctxp->rqb_buffer field is not checked in LS handling after the wqe is submitted. Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com> Signed-off-by: James Smart <jsmart2021@gmail.com> Reported-by: Ewan Milne <emilne@redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Diffstat (limited to 'drivers/scsi/lpfc/lpfc_nvmet.c')
-rw-r--r--drivers/scsi/lpfc/lpfc_nvmet.c1
1 files changed, 0 insertions, 1 deletions
diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c
index a943b2a20001..08c2c4e3515b 100644
--- a/drivers/scsi/lpfc/lpfc_nvmet.c
+++ b/drivers/scsi/lpfc/lpfc_nvmet.c
@@ -907,7 +907,6 @@ lpfc_nvmet_xmt_ls_rsp(struct nvmet_fc_target_port *tgtport,
* before freeing ctxp and iocbq.
*/
lpfc_in_buf_free(phba, &nvmebuf->dbuf);
- ctxp->rqb_buffer = 0;
atomic_inc(&nvmep->xmt_ls_rsp);
return 0;
}