diff options
| author | Nigel Kirkland <nkirkland2304@gmail.com> | 2026-10-12 17:16:41 -0700 |
|---|---|---|
| committer | Martin K. Petersen (Oracle) <mkp@kernel.org> | 2026-10-13 23:38:58 -0400 |
| commit | aef36d2e16f49e48e3569c547fe60edf5c2145a3 (patch) | |
| tree | 543668618a76805bcf37c69a49b35bcd9666653a /tools/lib/python/kdoc/python_version.py | |
| parent | cee9395acd8043be0644b25c34bfa86623f2b935 (diff) | |
| download | linux-next-aef36d2e16f49e48e3569c547fe60edf5c2145a3.tar.gz linux-next-aef36d2e16f49e48e3569c547fe60edf5c2145a3.zip | |
scsi: lpfc: Fix use-after-free in lpfc_cmpl_ct_cmd_vmid()
In lpfc_cmpl_ct_cmd_vmid(), there is an early call to
lpfc_ct_free_iocb() when cmd is SLI_CTAS_DALLAPP_ID. Within
lpfc_ct_free_iocb() the cmdiocb->rsp_dmabuf will be freed. This means
any ctrsp ptr dereference for SLI_CT_RESPONSE_FS_RJT or even
ctrsp->ReasonCode and ctrsp->Explanation when handling a CT LS_RJT
response is a use-after-free.
Remove the early lpfc_ct_free_iocb call for SLI_CTAS_DALLAPP_ID. There
already is a free_res label that calls lpfc_ct_free_iocb so there
doesn't need to be an early lpfc_ct_free_iocb at the start of
lpfc_cmpl_ct_cmd_vmid.
Signed-off-by: Nigel Kirkland <nkirkland2304@gmail.com>
Tested-by: Ewan D. Milne <emilne@redhat.com>
Link: https://patch.msgid.link/20261013001648.62289-2-nkirkland2304@gmail.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Diffstat (limited to 'tools/lib/python/kdoc/python_version.py')
0 files changed, 0 insertions, 0 deletions