github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

nvmet: prevent double-free after metadata SGL allocation failure

Browse Source 
If metadata SGL allocation fails, nvmet_req_alloc_sgls() frees
req->sg without clearing it. The RDMA error completion path later
frees the same scatterlist again.

Use nvmet_req_free_sgls() instead so that the scatterlist pointers
and counts are cleared before response cleanup.

Fixes: c6e3f13398 ("nvmet: add metadata support for block devices")
Signed-off-by: Avi Weiss <thnkslprpt@gmail.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
This commit is contained in:
Avi Weiss 2026-10-22 09:29:23 +03:00 committed by Keith Busch
parent 9fb4adbc39
commit 2f61b9d1d5
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/nvme/target/core.c
View File

@ -1357,7 +1357,7 @@ int nvmet_req_alloc_sgls(struct nvmet_req *req)
return 0;
out_free:
sgl_free(req->sg);
nvmet_req_free_sgls(req);
out:
return -ENOMEM;
}