Commit 67b483dd authored by Sagi Grimberg's avatar Sagi Grimberg

nvme-rdma: fix possible use-after-free in connect timeout

If the connect times out, we may have already destroyed the
queue in the timeout handler, so test if the queue is still
allocated in the connect error handler.
Reported-by: default avatarYi Zhang <yi.zhang@redhat.com>
Signed-off-by: default avatarSagi Grimberg <sagi@grimberg.me>
parent f968688f
...@@ -620,7 +620,8 @@ static int nvme_rdma_start_queue(struct nvme_rdma_ctrl *ctrl, int idx) ...@@ -620,7 +620,8 @@ static int nvme_rdma_start_queue(struct nvme_rdma_ctrl *ctrl, int idx)
if (!ret) { if (!ret) {
set_bit(NVME_RDMA_Q_LIVE, &queue->flags); set_bit(NVME_RDMA_Q_LIVE, &queue->flags);
} else { } else {
__nvme_rdma_stop_queue(queue); if (test_bit(NVME_RDMA_Q_ALLOCATED, &queue->flags))
__nvme_rdma_stop_queue(queue);
dev_info(ctrl->ctrl.device, dev_info(ctrl->ctrl.device,
"failed to connect queue: %d ret=%d\n", idx, ret); "failed to connect queue: %d ret=%d\n", idx, ret);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment