linux

iv/linux

History

Israel Rukshin 74c28abcb3 nvmet-rdma: fix double free of rdma queue

[ Upstream commit 21f9024355e58772ec5d7fc3534aa5e29d72a8b6 ]

In case rdma accept fails at nvmet_rdma_queue_connect(), release work is
scheduled. Later on, a new RDMA CM event may arrive since we didn't
destroy the cm-id and call nvmet_rdma_queue_connect_fail(), which
schedule another release work. This will cause calling
nvmet_rdma_free_queue twice. To fix this we implicitly destroy the cm_id
with non-zero ret code, which guarantees that new rdma_cm events will
not arrive afterwards. Also add a qp pointer to nvmet_rdma_queue
structure, so we can use it when the cm_id pointer is NULL or was
destroyed.

Signed-off-by: Israel Rukshin <israelr@mellanox.com>
Suggested-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Max Gurtovoy <maxg@mellanox.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2020-10-01 13:17:54 +02:00

admin-cmd.c

nvmet: fix a wrong error status returned in error log page

2019-09-12 08:50:46 -07:00

configfs.c

nvmet: Fix use-after-free bug when a port is removed

2019-07-31 17:57:06 -07:00

core.c

nvmet: Disable keep-alive timer when kato is cleared to 0h

2020-09-09 19:12:21 +02:00

discovery.c

nvmet: Use PTR_ERR_OR_ZERO() in nvmet_init_discovery()