[PATCH] nvmet: pci-epf: fix use-after-free in nvmet_pci_epf_exec_iod_work()

[Shin'ichiro Kawasaki]

On Jul 13, 2026 / 16:28, Damien Le Moal wrote:
> On 7/13/26 13:32, Shin'ichiro Kawasaki wrote:
> > nvmet_pci_epf_exec_iod_work() submits an I/O command with req->execute()
> > and then waits for the command to complete and transfers the data back
> > to the host. This wait is not needed for commands that do not transfer
> > data from the device to the host. To decide whether that wait is needed,
> > it reads iod->data_len and iod->dma_dir after calling req->execute().
> > 
> > However, once req->execute() is called, the command may complete
> > asynchronously on another CPU. For commands that do not require a
> > device-to-host data transfer, nvmet_pci_epf_queue_response() calls
> > nvmet_pci_epf_complete_iod() directly, which can free the iod before it
> > reads iod->data_len and iod->dma_dir, resulting in the KFENCE use-after-
> > free:
> > 
> >  BUG: KFENCE: use-after-free read in nvmet_pci_epf_exec_iod_work+0x288/0x798 [nvmet_pci_epf]
> 
> Looks good, but I would do it like this to simplify:

(snip)

Thanks. Will reflect the suggested change in v2.