diff options
| author |   Logan Gunthorpe <logang@deltatee.com> | 2019-07-31 17:35:31 -0600 |
|---|---|---|
| committer |   Sagi Grimberg <sagi@grimberg.me> | 2019-07-31 17:57:06 -0700 |
| commit | 3aed86731ee2b23e4dc4d2c6d943d33992cd551b (patch) | |
| tree | ec1c8fdaaae875427d39e0734626161419167293 /drivers/nvme/target/nvmet.h | |
| parent | nvme-multipath: revalidate nvme_ns_head gendisk in nvme_validate_ns (diff) | |
| download | linux-dev-3aed86731ee2b23e4dc4d2c6d943d33992cd551b.tar.xz linux-dev-3aed86731ee2b23e4dc4d2c6d943d33992cd551b.zip | |
nvmet: Fix use-after-free bug when a port is removed
When a port is removed through configfs, any connected controllers
are still active and can still send commands. This causes a
use-after-free bug which is detected by KASAN for any admin command
that dereferences req->port (like in nvmet_execute_identify_ctrl).
To fix this, disconnect all active controllers when a subsystem is
removed from a port. This ensures there are no active controllers
when the port is eventually removed.
Signed-off-by: Logan Gunthorpe <logang@deltatee.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Max Gurtovoy <maxg@mellanox.com>
Reviewed-by : Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Diffstat (limited to '')
| -rw-r--r-- | drivers/nvme/target/nvmet.h | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/nvme/target/nvmet.h b/drivers/nvme/target/nvmet.h index 6ee66c610739..c51f8dd01dc4 100644 --- a/drivers/nvme/target/nvmet.h +++ b/drivers/nvme/target/nvmet.h @@ -418,6 +418,9 @@ void nvmet_port_send_ana_event(struct nvmet_port *port); int nvmet_register_transport(const struct nvmet_fabrics_ops *ops); void nvmet_unregister_transport(const struct nvmet_fabrics_ops *ops); +void nvmet_port_del_ctrls(struct nvmet_port *port, + struct nvmet_subsys *subsys); + int nvmet_enable_port(struct nvmet_port *port); void nvmet_disable_port(struct nvmet_port *port); |