nvme-rdma: destroy cm id before destroy qp to avoid use after free
authorRuozhu Li <liruozhu@huawei.com>
Mon, 6 Sep 2021 03:51:34 +0000 (11:51 +0800)
committerChristoph Hellwig <hch@lst.de>
Tue, 14 Sep 2021 08:32:04 +0000 (10:32 +0200)
commit9817d763dbe15327b9b3ff4404fa6f27f927e744
treede515584710499481ffc30692b98c9edaaea84f8
parent79f528afa93918519574773ea49a444c104bc1bd
nvme-rdma: destroy cm id before destroy qp to avoid use after free

We should always destroy cm_id before destroy qp to avoid to get cma
event after qp was destroyed, which may lead to use after free.
In RDMA connection establishment error flow, don't destroy qp in cm
event handler.Just report cm_error to upper level, qp will be destroy
in nvme_rdma_alloc_queue() after destroy cm id.

Signed-off-by: Ruozhu Li <liruozhu@huawei.com>
Reviewed-by: Max Gurtovoy <mgurtovoy@nvidia.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
drivers/nvme/host/rdma.c