Re: [PATCH] nvmet-fc: fix use-after-free in nvmet_fc_ls_create_connection()

From: Keith Busch

Date: Wed Oct 21 2026 - 18:33:35 EST


On Sun, Oct 18, 2026 at 12:38:05AM +0900, Yehyeong Lee wrote:
> nvmet_fc_ls_create_connection() looks up the association with
> nvmet_fc_find_target_assoc(), which returns it with a reference held, and
> drops that reference as soon as the target queue has been allocated.
> iod->assoc is then dereferenced again by nvmet_fc_makeconnid() while
> building the connection id.

Thanks, applied to nvme-7.4.