diff options
| author | Yao Sang <sangyao@kylinos.cn> | 2026-09-22 15:37:30 +0800 |
|---|---|---|
| committer | Keith Busch <kbusch@kernel.org> | 2026-09-25 08:06:21 -0700 |
| commit | 72ece656abd4de8645a421fb482d7a11e6533a45 (patch) | |
| tree | b3c4d57c200838d74e5499283ecb550b316093f6 /tools/perf/scripts/python | |
| parent | 3fdd281e0a049a804b2512c4cb3d685e5358aee8 (diff) | |
| download | linux-next-72ece656abd4de8645a421fb482d7a11e6533a45.tar.gz linux-next-72ece656abd4de8645a421fb482d7a11e6533a45.zip | |
nvme: fix command effects log lifetime for multipath heads
KASAN reported a use-after-free when an I/O passthrough command was sent
through a multipath namespace head after the controller path that first
created the head had been removed:
BUG: KASAN: slab-use-after-free in nvme_command_effects+0x192/0x200 [nvme_core]
Read of size 4 at addr ffff888141b14400 by task nvme/19811
nvme_command_effects+0x192/0x200 [nvme_core]
nvme_cmd_allowed+0x7e/0x1b0 [nvme_core]
nvme_user_cmd.constprop.0+0x1b5/0x450 [nvme_core]
nvme_ns_head_chr_ioctl+0xf4/0x2a0 [nvme_core]
Move the log cache to the subsystem, with one entry per command set. Both
controllers and namespace heads hold subsystem references, keeping their
log pointers valid until subsystem release.
Fixes: be93e87e7802 ("nvme: support for multiple Command Sets Supported and Effects log pages")
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Yao Sang <sangyao@kylinos.cn>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Diffstat (limited to 'tools/perf/scripts/python')
0 files changed, 0 insertions, 0 deletions