Commit 16a5a480 authored by James Smart's avatar James Smart Committed by Christoph Hellwig

nvmet-fc: correct use after free on list teardown

Use list_for_each_entry_safe to prevent list handling from referencing
next pointers directly after list_del's
Signed-off-by: default avatarJames Smart <james.smart@broadcom.com>
Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
parent 42819eb7
...@@ -704,7 +704,7 @@ nvmet_fc_delete_target_queue(struct nvmet_fc_tgt_queue *queue) ...@@ -704,7 +704,7 @@ nvmet_fc_delete_target_queue(struct nvmet_fc_tgt_queue *queue)
{ {
struct nvmet_fc_tgtport *tgtport = queue->assoc->tgtport; struct nvmet_fc_tgtport *tgtport = queue->assoc->tgtport;
struct nvmet_fc_fcp_iod *fod = queue->fod; struct nvmet_fc_fcp_iod *fod = queue->fod;
struct nvmet_fc_defer_fcp_req *deferfcp; struct nvmet_fc_defer_fcp_req *deferfcp, *tempptr;
unsigned long flags; unsigned long flags;
int i, writedataactive; int i, writedataactive;
bool disconnect; bool disconnect;
...@@ -735,7 +735,8 @@ nvmet_fc_delete_target_queue(struct nvmet_fc_tgt_queue *queue) ...@@ -735,7 +735,8 @@ nvmet_fc_delete_target_queue(struct nvmet_fc_tgt_queue *queue)
} }
/* Cleanup defer'ed IOs in queue */ /* Cleanup defer'ed IOs in queue */
list_for_each_entry(deferfcp, &queue->avail_defer_list, req_list) { list_for_each_entry_safe(deferfcp, tempptr, &queue->avail_defer_list,
req_list) {
list_del(&deferfcp->req_list); list_del(&deferfcp->req_list);
kfree(deferfcp); kfree(deferfcp);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment