Skip to content

nvmet-tcp: fix crypto_ahash double free memory corrupter

John Meneghini requested to merge johnmeneghini/centos-stream-9:nvmet_free_crypto_fix2 into main

Move the crypto_alloc/free_ahash calls out of nvmet_tcp_handle_icreq and put them in nvmet_tcp_alloc_queue.

This avoids a race condition with nvmet_tcp_release_queue_work which attempts to free the ashash twice in cases where nvmet_tcp_handle_icreq fails at kernel_sendmsg().

JIRA: https://issues.redhat.com/browse/RHEL-11488

Upstream Status: RHEL only

Signed-off-by: John Meneghini jmeneghi@redhat.com

Edited by John Meneghini

Merge request reports