From 2f61b9d1d54edf75a352c43eebe3804144b5d44e Mon Sep 17 00:00:00 2001 From: Avi Weiss Date: Thu, 22 Oct 2026 09:29:23 +0300 Subject: [PATCH] nvmet: prevent double-free after metadata SGL allocation failure If metadata SGL allocation fails, nvmet_req_alloc_sgls() frees req->sg without clearing it. The RDMA error completion path later frees the same scatterlist again. Use nvmet_req_free_sgls() instead so that the scatterlist pointers and counts are cleared before response cleanup. Fixes: c6e3f13398123 ("nvmet: add metadata support for block devices") Signed-off-by: Avi Weiss Signed-off-by: Keith Busch --- drivers/nvme/target/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c index 2e4e066ef6ba..4955872dc1fc 100644 --- a/drivers/nvme/target/core.c +++ b/drivers/nvme/target/core.c @@ -1357,7 +1357,7 @@ int nvmet_req_alloc_sgls(struct nvmet_req *req) return 0; out_free: - sgl_free(req->sg); + nvmet_req_free_sgls(req); out: return -ENOMEM; }