Commit a28294b0 authored by Ben Walker's avatar Ben Walker
Browse files

bdev/nvme: Fix use after free in apply firmware RPC 



Change-Id: I7ffe73e803ef416ce698df2d8403e32fa94ebccd
Signed-off-by: default avatarBen Walker <benjamin.walker@intel.com>
Reviewed-on: https://review.gerrithub.io/406988


Tested-by: default avatarSPDK Automated Test System <sys_sgsw@intel.com>
Reviewed-by: default avatarDaniel Verkamp <daniel.verkamp@intel.com>
Reviewed-by: default avatarJim Harris <james.r.harris@intel.com>
parent 83b9f686

lib/bdev/nvme/bdev_nvme_rpc.c

+3 −2
Original line number Diff line number Diff line
@@ -193,7 +193,7 @@ struct firmware_update_info { 
static void

apply_firmware_cleanup(void *cb_arg)

{

	struct open_descriptors			*opt;

	struct open_descriptors			*opt, *tmp;

	struct firmware_update_info *firm_ctx = cb_arg;



	if (!firm_ctx) {
@@ -208,7 +208,8 @@ apply_firmware_cleanup(void *cb_arg) 
		free_rpc_apply_firmware(firm_ctx->req);

		free(firm_ctx->req);

	}

	TAILQ_FOREACH(opt, &firm_ctx->desc_head, tqlst) {

	TAILQ_FOREACH_SAFE(opt, &firm_ctx->desc_head, tqlst, tmp) {

		TAILQ_REMOVE(&firm_ctx->desc_head, opt, tqlst);

		spdk_bdev_close(opt->desc);

		free(opt);

	}