Re: [PATCH v2 1/2] nvmet_fc: add defer_req callback for deferment of cmd buffer return

[Bart Van Assche]

On 08/04/17 17:29, James Smart wrote:
> +     /* Cleanup defer'ed IOs in queue */
> +     list_for_each_entry(deferfcp, &queue->avail_defer_list, req_list) {
> +             list_del(&deferfcp->req_list);
> +             kfree(deferfcp);
> +     }

Hello James,

Coverity reports a user-after-free for the above code:

*** CID 1416424:  Memory - illegal accesses  (USE_AFTER_FREE)
/drivers/nvme/target/fc.c: 738 in nvmet_fc_delete_target_queue()
732                                             &tgtport->fc_target_port, 
fod->fcpreq);
733                             }
734                     }
735             }
736     
737             /* Cleanup defer'ed IOs in queue */
>>>     CID 1416424:  Memory - illegal accesses  (USE_AFTER_FREE)
>>>     Dereferencing freed pointer "deferfcp".
738             list_for_each_entry(deferfcp, &queue->avail_defer_list, 
req_list) {
739                     list_del(&deferfcp->req_list);
740                     kfree(deferfcp);
741             }
742     
743             for (;;) {