Commit 74482154 authored by Jacek Kalwas's avatar Jacek Kalwas Committed by Tomasz Zawadzki
Browse files

nvmf/ctrlr: cache opc & fctype info 



Request can be freed by transport_req_complete. In such case req
or req->cmd dereference might result in heap-use-after-free.

Signed-off-by: default avatarJacek Kalwas <jacek.kalwas@intel.com>
Change-Id: I2280d3978f1f183a250828aab7d2ca49ef1800ec
Reviewed-on: https://review.gerrithub.io/c/spdk/spdk/+/476929


Tested-by: default avatarSPDK CI Jenkins <sys_sgci@intel.com>
Community-CI: SPDK CI Jenkins <sys_sgci@intel.com>
Reviewed-by: default avatarTomasz Zawadzki <tomasz.zawadzki@intel.com>
Reviewed-by: default avatarJim Harris <james.r.harris@intel.com>
Reviewed-by: default avatarBen Walker <benjamin.walker@intel.com>
parent 78433210

lib/nvmf/ctrlr.c

+3 −3
Original line number Diff line number Diff line
@@ -2484,6 +2484,8 @@ spdk_nvmf_request_complete(struct spdk_nvmf_request *req) 
	struct spdk_nvme_cpl *rsp = &req->rsp->nvme_cpl;

	struct spdk_nvmf_qpair *qpair;

	struct spdk_nvmf_subsystem_poll_group *sgroup = NULL;

	bool is_connect = req->cmd->nvmf_cmd.opcode == SPDK_NVME_OPC_FABRIC &&

			  req->cmd->nvmf_cmd.fctype == SPDK_NVMF_FABRIC_COMMAND_CONNECT;



	rsp->sqid = 0;

	rsp->status.p = 0;
@@ -2505,9 +2507,7 @@ spdk_nvmf_request_complete(struct spdk_nvmf_request *req) 
	}



	/* AER cmd and fabric connect are exceptions */

	if (sgroup != NULL && qpair->ctrlr->aer_req != req &&

	    !(req->cmd->nvmf_cmd.opcode == SPDK_NVME_OPC_FABRIC &&

	      req->cmd->nvmf_cmd.fctype == SPDK_NVMF_FABRIC_COMMAND_CONNECT)) {

	if (sgroup != NULL && qpair->ctrlr->aer_req != req && !is_connect) {

		assert(sgroup->io_outstanding > 0);

		sgroup->io_outstanding--;

		if (sgroup->state == SPDK_NVMF_SUBSYSTEM_PAUSING &&