]> git.baikalelectronics.ru Git - kernel.git/commit
nvme-rdma: destroy cm id before destroy qp to avoid use after free
authorRuozhu Li <liruozhu@huawei.com>
Mon, 6 Sep 2021 03:51:34 +0000 (11:51 +0800)
committerChristoph Hellwig <hch@lst.de>
Tue, 14 Sep 2021 08:32:04 +0000 (10:32 +0200)
commit12367cd31a4f1040c3eda6001ae2601997a02701
treede515584710499481ffc30692b98c9edaaea84f8
parentbd5a8c5a0a7b119f21e38f285c8e16207f7379f0
nvme-rdma: destroy cm id before destroy qp to avoid use after free

We should always destroy cm_id before destroy qp to avoid to get cma
event after qp was destroyed, which may lead to use after free.
In RDMA connection establishment error flow, don't destroy qp in cm
event handler.Just report cm_error to upper level, qp will be destroy
in nvme_rdma_alloc_queue() after destroy cm id.

Signed-off-by: Ruozhu Li <liruozhu@huawei.com>
Reviewed-by: Max Gurtovoy <mgurtovoy@nvidia.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
drivers/nvme/host/rdma.c