Searched hist:"7961 cba6f7d8215fa632df3d220e5154bb825249" (Results 1 – 2 of 2) sorted by relevance
| /linux/drivers/scsi/lpfc/ |
| H A D | lpfc_nvme.h | diff 7961cba6f7d8215fa632df3d220e5154bb825249 Thu Jan 17 17:14:44 CET 2019 Ewan D. Milne <emilne@redhat.com> scsi: lpfc: nvme: avoid hang / use-after-free when destroying localport
We cannot wait on a completion object in the lpfc_nvme_lport structure in
the _destroy_localport() code path because the NVMe/fc transport will free
that structure immediately after the .localport_delete() callback. This
results in a use-after-free, and a hang if slub_debug=FZPU is enabled.
Fix this by putting the completion on the stack.
Signed-off-by: Ewan D. Milne <emilne@redhat.com>
Acked-by: James Smart <james.smart@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
|
| H A D | lpfc_nvme.c | diff 7961cba6f7d8215fa632df3d220e5154bb825249 Thu Jan 17 17:14:44 CET 2019 Ewan D. Milne <emilne@redhat.com> scsi: lpfc: nvme: avoid hang / use-after-free when destroying localport
We cannot wait on a completion object in the lpfc_nvme_lport structure in
the _destroy_localport() code path because the NVMe/fc transport will free
that structure immediately after the .localport_delete() callback. This
results in a use-after-free, and a hang if slub_debug=FZPU is enabled.
Fix this by putting the completion on the stack.
Signed-off-by: Ewan D. Milne <emilne@redhat.com>
Acked-by: James Smart <james.smart@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
|