scsi: lpfc: Prevent 'use after free' memory overwrite in nvmet LS handling
authorJames Smart <jsmart2021@gmail.com>
Wed, 22 May 2019 00:48:59 +0000 (17:48 -0700)
committerMartin K. Petersen <martin.petersen@oracle.com>
Tue, 18 Jun 2019 23:46:21 +0000 (19:46 -0400)
commit51d23fb28ccb355ee4d26dedacca24c171c2f664
tree244cede07ab0daea39724fc51adfa1cd3583abdd
parentf22bfe8d1c900b8ce2105223db69742d8ebc46fe
scsi: lpfc: Prevent 'use after free' memory overwrite in nvmet LS handling

Use-after-free memory overwrite detected. Problem reported
by Ewan Milne at Red Hat after running lpfc target with additional
memory checking enabled.

Race condition when lpfc_nvmet_xmt_ls_rsp_cmp frees the ctxp
memory in interrupt context before lpfc_nvmet_xmt_ls_rsp
clears a field in the ctxp after successfully issuing the wqe.

Remove the unnecessary ctxp write after reposting the rq buffer. The
ctxp->rqb_buffer field is not checked in LS handling after the wqe
is submitted.

Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: James Smart <jsmart2021@gmail.com>
Reported-by: Ewan Milne <emilne@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
drivers/scsi/lpfc/lpfc_nvmet.c