Commit b4dfd6ee authored Jun 21, 2017 by James Smart Committed by Jens Axboe Jun 28, 2017

nvme_fc: fix double calls to nvme_cleanup_cmd()



Current fc transport code, on io termination, is calling
nvme_cleanup_cmd() followed by the transport dma unmap routine
which also calls nvme_cleanup_cmd(). Which means two kfrees occur
on the same address, raising havoc. This resulted in odd data errors,
effectively corruption..

Fix by removing the extraneous double calls. Call now occurs only in
teardown paths and as part of dma unmap routine.

Signed-off-by: James Smart <james.smart@broadcom.com>
Reviewed-by: Ewan D. Milne <emilne@redhat.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Keith Busch <keith.busch@intel.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

parent b1465c63

drivers/nvme/host/fc.c

+1 −4

Original line number	Diff line number	Diff line
		@@ -1957,10 +1957,8 @@ nvme_fc_start_fcp_op(struct nvme_fc_ctrl ctrl, struct nvme_fc_queue queue,
		queue->lldd_handle, &op->fcp_req);

		if (ret) {
		if (op->rq) { /* normal request */
		if (op->rq) /* normal request */
		nvme_fc_unmap_data(ctrl, op->rq, op);
		nvme_cleanup_cmd(op->rq);
		}
		/* else - aen. no cleanup needed */

		nvme_fc_ctrl_put(ctrl);
		@@ -2078,7 +2076,6 @@ __nvme_fc_final_op_cleanup(struct request *rq)
		op->flags &= ~(FCOP_FLAGS_TERMIO \| FCOP_FLAGS_RELEASED \|
		FCOP_FLAGS_COMPLETE);

		nvme_cleanup_cmd(rq);
		nvme_fc_unmap_data(ctrl, rq, op);
		nvme_complete_rq(rq);
		nvme_fc_ctrl_put(ctrl);

Admin message