nvme-rdma: Fix possible double free in reconnect flow
authorSagi Grimberg <sagi@grimberg.me>
Thu, 19 Oct 2017 13:00:30 +0000 (16:00 +0300)
committerChristoph Hellwig <hch@lst.de>
Thu, 19 Oct 2017 15:07:22 +0000 (17:07 +0200)
commitbd9f07590a17f3158b51fb869dca723f1f606bdc
treee7a19c5b8fd5bc31285c6ce7dcdf57ad062671ec
parentf9cf2a64912d67c9cf49c316a0a0ada0ea7ed1da
nvme-rdma: Fix possible double free in reconnect flow

The fact that we free the async event buffer in
nvme_rdma_destroy_admin_queue can cause us to free it
more than once because this happens in every reconnect
attempt since commit 31fdf1840170. we rely on the queue
state flags DELETING to avoid this for other resources.

A more complete fix is to not destroy the admin/io queues
unconditionally on every reconnect attempt, but its a bit
more extensive and will go in the next release.

Fixes: 31fdf1840170 ("nvme-rdma: reuse configure/destroy_admin_queue")
Reported-by: Yi Zhang <yi.zhang@redhat.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Christoph Hellwig <hch@lst.de>
drivers/nvme/host/rdma.c