Skip to contentSkip to conversation

nvme-rdma: Fix error status return in tagset allocation failure

PATCH New Sagi Grimberg 2 participants 2 messages Oct 19, 2017 NVMe

lore
Share & tools
lore

Sagi Grimberg

author maintainer
#0 lore raw

PATCH v2 1/1 nvme-rdma: Fix error status return in tagset allocation failure

We should make sure to escelate allocation failures to prevent a use-after-free in nvmf_create_ctrl.

Fixes b28a308ee777 ("nvme-rdma: move tagset allocation to

a dedicated routine")
Signed-off-by: Sagi Grimberg <sagi at grimberg.me>
---
Chnages from v1:
- fixed changelog

 drivers/nvme/host/rdma.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/nvme/host/rdma.c +6 -2
index a5577e06a620..1f01744d859f 100644
@@ -766,8 +766,10 @@ static int nvme_rdma_configure_admin_queue(struct nvme_rdma_ctrl *ctrl,
 
 	if (new) {
 		ctrl->ctrl.admin_tagset = nvme_rdma_alloc_tagset(&ctrl->ctrl, true);
-		if (IS_ERR(ctrl->ctrl.admin_tagset))
+		if (IS_ERR(ctrl->ctrl.admin_tagset)) {
+			error = PTR_ERR(ctrl->ctrl.admin_tagset);
 			goto out_free_queue;
+		}
 
 		ctrl->ctrl.admin_q = blk_mq_init_queue(&ctrl->admin_tag_set);
 		if (IS_ERR(ctrl->ctrl.admin_q)) {

@@ -846,8 +848,10 @@ static int nvme_rdma_configure_io_queues(struct nvme_rdma_ctrl *ctrl, bool new)
 
 	if (new) {
 		ctrl->ctrl.tagset = nvme_rdma_alloc_tagset(&ctrl->ctrl, false);
-		if (IS_ERR(ctrl->ctrl.tagset))
+		if (IS_ERR(ctrl->ctrl.tagset)) {
+			ret = PTR_ERR(ctrl->ctrl.tagset);
 			goto out_free_io_queues;
+		}
 
 		ctrl->ctrl.connect_q = blk_mq_init_queue(&ctrl->tag_set);
 		if (IS_ERR(ctrl->ctrl.connect_q)) {
Signature · 1 line
2.7.4
maintainer Applied
#1 lore raw

PATCH v2 1/1 nvme-rdma: Fix error status return in tagset allocation failure

Thanks,

applied to nvme-4.14.