Commit 67b483dd authored Sep 24, 2019 by Sagi Grimberg

nvme-rdma: fix possible use-after-free in connect timeout



If the connect times out, we may have already destroyed the
queue in the timeout handler, so test if the queue is still
allocated in the connect error handler.

Reported-by: Yi Zhang <yi.zhang@redhat.com>
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>

parent f968688f

drivers/nvme/host/rdma.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -620,6 +620,7 @@ static int nvme_rdma_start_queue(struct nvme_rdma_ctrl *ctrl, int idx)
		if (!ret) {
		set_bit(NVME_RDMA_Q_LIVE, &queue->flags);
		} else {
		if (test_bit(NVME_RDMA_Q_ALLOCATED, &queue->flags))
		__nvme_rdma_stop_queue(queue);
		dev_info(ctrl->ctrl.device,
		"failed to connect queue: %d ret=%d\n", idx, ret);

Admin message