Commit 16a5a480 authored by James Smart's avatar James Smart Committed by Christoph Hellwig
Browse files

nvmet-fc: correct use after free on list teardown 



Use list_for_each_entry_safe to prevent list handling from referencing
next pointers directly after list_del's

Signed-off-by: default avatarJames Smart <james.smart@broadcom.com>
Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
parent 42819eb7

drivers/nvme/target/fc.c

+3 −2
Original line number Diff line number Diff line
@@ -704,7 +704,7 @@ nvmet_fc_delete_target_queue(struct nvmet_fc_tgt_queue *queue) 
{

	struct nvmet_fc_tgtport *tgtport = queue->assoc->tgtport;

	struct nvmet_fc_fcp_iod *fod = queue->fod;

	struct nvmet_fc_defer_fcp_req *deferfcp;

	struct nvmet_fc_defer_fcp_req *deferfcp, *tempptr;

	unsigned long flags;

	int i, writedataactive;

	bool disconnect;
@@ -735,7 +735,8 @@ nvmet_fc_delete_target_queue(struct nvmet_fc_tgt_queue *queue) 
	}



	/* Cleanup defer'ed IOs in queue */

	list_for_each_entry(deferfcp, &queue->avail_defer_list, req_list) {

	list_for_each_entry_safe(deferfcp, tempptr, &queue->avail_defer_list,

				req_list) {

		list_del(&deferfcp->req_list);

		kfree(deferfcp);

	}