d/numam-spdk
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

nvmf/fc: Fix use after free issue.

Browse Source 
As fc_req is freed in the previous step, using fc_req->hwqp
results in segfault. Fix this.

Signed-off-by: Naresh Gottumukkala <raju.gottumukkala@broadcom.com>
Change-Id: I9d82f62a24e8c139b1971466948fc5aa3513f4ea
Reviewed-on: https://review.spdk.io/gerrit/c/spdk/spdk/+/5826
Community-CI: Broadcom CI
Community-CI: Mellanox Build Bot
Tested-by: SPDK CI Jenkins <sys_sgci@intel.com>
Reviewed-by: Jim Harris <james.r.harris@intel.com>
Reviewed-by: Shuhei Matsumoto <shuhei.matsumoto.xt@hitachi.com>
This commit is contained in:
Naresh Gottumukkala 2021-01-08 02:44:58 +00:00 committed by Tomasz Zawadzki
parent cf07c1f7be
commit 74669b90fc
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
lib/nvmf/fc.c
View File

@ -1264,6 +1264,7 @@ nvmf_fc_request_abort_complete(void *arg1)
{
struct spdk_nvmf_fc_request *fc_req =
(struct spdk_nvmf_fc_request *)arg1;
struct spdk_nvmf_fc_hwqp *hwqp = fc_req->hwqp;
struct spdk_nvmf_fc_caller_ctx *ctx = NULL, *tmp = NULL;
TAILQ_HEAD(, spdk_nvmf_fc_caller_ctx) abort_cbs;
@ -1279,7 +1280,7 @@ nvmf_fc_request_abort_complete(void *arg1)
/* Request abort completed. Notify all the callbacks */
TAILQ_FOREACH_SAFE(ctx, &abort_cbs, link, tmp) {
/* Notify */
ctx->cb(fc_req->hwqp, 0, ctx->cb_args);
ctx->cb(hwqp, 0, ctx->cb_args);
/* Remove */
TAILQ_REMOVE(&abort_cbs, ctx, link);
/* free */