diff options
| author | Lv Yunlong <[email protected]> | 2021-03-10 21:44:13 -0800 |
|---|---|---|
| committer | Christoph Hellwig <[email protected]> | 2021-03-11 11:48:35 +0100 |
| commit | abec6561fc4e0fbb19591a0b35676d8c783b5493 (patch) | |
| tree | 45d82d378dcc4a813f3ee416beea0319401f24bd /lib/mpi/mpiutil.c | |
| parent | 0ec84df4953bd42c6583a555773f1d4996a061eb (diff) | |
nvme-rdma: Fix a use after free in nvmet_rdma_write_data_done
In nvmet_rdma_write_data_done, rsp is recoverd by wc->wr_cqe and freed by
nvmet_rdma_release_rsp(). But after that, pr_info() used the freed
chunk's member object and could leak the freed chunk address with
wc->wr_cqe by computing the offset.
Signed-off-by: Lv Yunlong <[email protected]>
Signed-off-by: Christoph Hellwig <[email protected]>
Diffstat (limited to 'lib/mpi/mpiutil.c')
0 files changed, 0 insertions, 0 deletions