If a remote host initiates a shutdown or controller reset by setting
the CC property but leaves the admin queue connected at the transport
level, a timeout task is scheduled to drop the association after 2
minutes.
Previously, if the remote host re-enabled the controller after the
shutdown or reset had completed by setting CC.EN=1, the timeout task
was left queued. If the association remained active when the task
ran, the task handler recognized this case and exited without doing
anything. However, if the admin queue disconnected at the transport
level (e.g. closed the TCP socket), the memory backing the queue was
freed while the task was still queued leading to a use-after-free when
the task eventualy ran.
To fix, explicitly cancel and drain the terminate task when enabling a
controller before sending the response back acknowledging the request
to alter CC.
Reported by: Myeonghun Pak <mhun512@gmail.com>
Sponsored by: Chelsio Communications