Commit 6173a77b authored by Damien Le Moal's avatar Damien Le Moal Committed by Christoph Hellwig
Browse files

nvmet: avoid potential UAF in nvmet_req_complete() 



An nvme target ->queue_response() operation implementation may free the
request passed as argument. Such implementation potentially could result
in a use after free of the request pointer when percpu_ref_put() is
called in nvmet_req_complete().

Avoid such problem by using a local variable to save the sq pointer
before calling __nvmet_req_complete(), thus avoiding dereferencing the
req pointer after that function call.

Fixes: a07b4970 ("nvmet: add a generic NVMe target")
Signed-off-by: default avatarDamien Le Moal <damien.lemoal@opensource.wdc.com>
Reviewed-by: default avatarChaitanya Kulkarni <kch@nvidia.com>
Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
parent 8e19b87c

drivers/nvme/target/core.c

+3 −1
Original line number Diff line number Diff line
@@ -756,8 +756,10 @@ static void __nvmet_req_complete(struct nvmet_req *req, u16 status) 


void nvmet_req_complete(struct nvmet_req *req, u16 status)

{

	struct nvmet_sq *sq = req->sq;



	__nvmet_req_complete(req, status);

	percpu_ref_put(&req->sq->ref);

	percpu_ref_put(&sq->ref);

}

EXPORT_SYMBOL_GPL(nvmet_req_complete);