summaryrefslogtreecommitdiff
path: root/drivers/nvme
diff options
context:
space:
mode:
authorChristoph Hellwig <hch@lst.de>2016-08-18 11:16:35 -0700
committerSagi Grimberg <sagi@grimberg.me>2016-08-19 14:22:12 +0300
commit98096d8a787f05b1afe3869aa01e84981915c81d (patch)
treeb4b303fd633b44036c38c7448a2fee46cdb46c80 /drivers/nvme
parent7a665d2f60b457c0d77b3e4f01e21c55ffc57069 (diff)
nvme-fabrics: get a reference when reusing a nvme_host structure
Without this we'll get a use after free after connecting two controller using the same hostnqn and then disconnecting one of them. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Jay Freyensee <james_p_freyensee@linux.intel.com> Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Diffstat (limited to 'drivers/nvme')
-rw-r--r--drivers/nvme/host/fabrics.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c
index be0b1067c9fa..4eff49174466 100644
--- a/drivers/nvme/host/fabrics.c
+++ b/drivers/nvme/host/fabrics.c
@@ -47,8 +47,10 @@ static struct nvmf_host *nvmf_host_add(const char *hostnqn)
mutex_lock(&nvmf_hosts_mutex);
host = __nvmf_host_find(hostnqn);
- if (host)
+ if (host) {
+ kref_get(&host->ref);
goto out_unlock;
+ }
host = kmalloc(sizeof(*host), GFP_KERNEL);
if (!host)