diff mbox series

[SRU,F,1/1] nvme: avoid double free special payload

Message ID 20240913081209.1659072-2-koichiro.den@canonical.com
State New
Headers show
Series CVE-2024-41073 | expand

Commit Message

Koichiro Den Sept. 13, 2024, 8:12 a.m. UTC 
From: Chunguang Xu <chunguang.xu@shopee.com>

If a discard request needs to be retried, and that retry may fail before
a new special payload is added, a double free will result. Clear the
RQF_SPECIAL_LOAD when the request is cleaned.

Signed-off-by: Chunguang Xu <chunguang.xu@shopee.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Max Gurtovoy <mgurtovoy@nvidia.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
(backported from commit e5d574ab37f5f2e7937405613d9b1a724811e5ad)
[koichiroden: Adjusted context due to a missing commit
 3973e15fa534 ("nvme: use bvec_virt")]
CVE-2024-41073
Signed-off-by: Koichiro Den <koichiro.den@canonical.com>
---
 drivers/nvme/host/core.c | 1 +
 1 file changed, 1 insertion(+)
diff mbox series

Patch

diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 9144ed14b074..250e933020f9 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -765,6 +765,7 @@  void nvme_cleanup_cmd(struct request *req)
 			clear_bit_unlock(0, &ns->ctrl->discard_page_busy);
 		else
 			kfree(page_address(page) + req->special_vec.bv_offset);
+		req->rq_flags &= ~RQF_SPECIAL_PAYLOAD;
 	}
 }
 EXPORT_SYMBOL_GPL(nvme_cleanup_cmd);