| commit | abec6561fc4e0fbb19591a0b35676d8c783b5493 | [log] [tgz] |
|---|---|---|
| author | Lv Yunlong <lyl2019@mail.ustc.edu.cn> | Wed Mar 10 21:44:13 2021 -0800 |
| committer | Christoph Hellwig <hch@lst.de> | Thu Mar 11 11:48:35 2021 +0100 |
| tree | 45d82d378dcc4a813f3ee416beea0319401f24bd | |
| parent | 0ec84df4953bd42c6583a555773f1d4996a061eb [diff] |
nvme-rdma: Fix a use after free in nvmet_rdma_write_data_done In nvmet_rdma_write_data_done, rsp is recoverd by wc->wr_cqe and freed by nvmet_rdma_release_rsp(). But after that, pr_info() used the freed chunk's member object and could leak the freed chunk address with wc->wr_cqe by computing the offset. Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn> Signed-off-by: Christoph Hellwig <hch@lst.de>