Request can be freed by transport_req_complete. In such case req or req->cmd dereference might result in heap-use-after-free. Signed-off-by: Jacek Kalwas <jacek.kalwas@intel.com> Change-Id: I2280d3978f1f183a250828aab7d2ca49ef1800ec Reviewed-on: https://review.gerrithub.io/c/spdk/spdk/+/476929 Tested-by: SPDK CI Jenkins <sys_sgci@intel.com> Community-CI: SPDK CI Jenkins <sys_sgci@intel.com> Reviewed-by: Tomasz Zawadzki <tomasz.zawadzki@intel.com> Reviewed-by: Jim Harris <james.r.harris@intel.com> Reviewed-by: Ben Walker <benjamin.walker@intel.com> |
||
---|---|---|
.. | ||
ctrlr_bdev.c | ||
ctrlr_discovery.c | ||
ctrlr.c | ||
fc_ls.c | ||
fc.c | ||
Makefile | ||
nvmf_fc.h | ||
nvmf_internal.h | ||
nvmf_rpc.c | ||
nvmf.c | ||
rdma.c | ||
subsystem.c | ||
tcp.c | ||
transport.c | ||
transport.h |