Commit 6e17f58c authored Jan 05, 2019 by Dan Carpenter Committed by Anna Schumaker Jan 08, 2019

xprtrdma: Double free in rpcrdma_sendctxs_create()

The clean up is handled by the caller, rpcrdma_buffer_create(), so this
call to rpcrdma_sendctxs_destroy() leads to a double free.

Fixes: ae72950a ("xprtrdma: Add data structure to manage RDMA Send arguments")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>

parent 4429b668

net/sunrpc/xprtrdma/verbs.c

+1 −5

Original line number	Diff line number	Diff line
		@@ -845,17 +845,13 @@ static int rpcrdma_sendctxs_create(struct rpcrdma_xprt *r_xprt)
		for (i = 0; i <= buf->rb_sc_last; i++) {
		sc = rpcrdma_sendctx_create(&r_xprt->rx_ia);
		if (!sc)
		goto out_destroy;
		return -ENOMEM;

		sc->sc_xprt = r_xprt;
		buf->rb_sc_ctxs[i] = sc;
		}

		return 0;

		out_destroy:
		rpcrdma_sendctxs_destroy(buf);
		return -ENOMEM;
		}

		/* The sendctx queue is not guaranteed to have a size that is a