Commit 3ff652be authored by Chunguang Xu's avatar Chunguang Xu Committed by Li Lingfeng
Browse files

nvme: avoid double free special payload 

mainline inclusion
from mainline-v6.10-rc4
commit e5d574ab37f5f2e7937405613d9b1a724811e5ad
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEML
CVE: CVE-2024-41073

Reference:  https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=e5d574ab37f5f2e7937405613d9b1a724811e5ad



---------------------------

If a discard request needs to be retried, and that retry may fail before
a new special payload is added, a double free will result. Clear the
RQF_SPECIAL_LOAD when the request is cleaned.

Signed-off-by: default avatarChunguang Xu <chunguang.xu@shopee.com>
Reviewed-by: default avatarSagi Grimberg <sagi@grimberg.me>
Reviewed-by: default avatarMax Gurtovoy <mgurtovoy@nvidia.com>
Signed-off-by: default avatarKeith Busch <kbusch@kernel.org>

Conflicts:
  drivers/nvme/host/core.c
[Commit 3973e15f("nvme: use bvec_virt") change to use bvec_virt to get
page address]
Signed-off-by: default avatarLi Lingfeng <lilingfeng3@huawei.com>
parent 525a05ab

drivers/nvme/host/core.c

+1 −0
Original line number Diff line number Diff line
@@ -850,6 +850,7 @@ void nvme_cleanup_cmd(struct request *req) 
			clear_bit_unlock(0, &ns->ctrl->discard_page_busy);

		else

			kfree(page_address(page) + req->special_vec.bv_offset);

		req->rq_flags &= ~RQF_SPECIAL_PAYLOAD;

	}

}

EXPORT_SYMBOL_GPL(nvme_cleanup_cmd);