Skip to contentSkip to conversation

drivers/nvme/host/rdma.c: Fix double freeing of async event data

PATCH New Prabhath Sajeepa 5 participants 5 messages Nov 26, 2018 – Nov 27, 2018 NVMe

lore
Share & tools
lore

Prabhath Sajeepa

author
#0 lore raw

PATCH 1/1 drivers/nvme/host/rdma.c: Fix double freeing of async event data

Some error paths in configuration of admin queue free data buffer associated with async request SQE without resetting the data buffer pointer to NULL, This buffer is also freed up again if the controller is shutdown or reset.

---
 drivers/nvme/host/rdma.c | 2 ++
 1 file changed, 2 insertions(+)
drivers/nvme/host/rdma.c +2 -0
index d181caf..ab6ec72 100644
@@ -184,6 +184,7 @@ static int nvme_rdma_alloc_qe(struct ib_device *ibdev, struct nvme_rdma_qe *qe,
 	qe->dma = ib_dma_map_single(ibdev, qe->data, capsule_size, dir);
 	if (ib_dma_mapping_error(ibdev, qe->dma)) {
 		kfree(qe->data);
+		qe->data = NULL;
 		return -ENOMEM;
 	}
 

@@ -823,6 +824,7 @@ static int nvme_rdma_configure_admin_queue(struct nvme_rdma_ctrl *ctrl,
 out_free_async_qe:
 	nvme_rdma_free_qe(ctrl->device->dev, &ctrl->async_event_sqe,
 		sizeof(struct nvme_command), DMA_TO_DEVICE);
+	ctrl->async_event_sqe.data = NULL;
 out_free_queue:
 	nvme_rdma_free_queue(&ctrl->queues[0]);
 	return error;
Signature · 1 line
2.7.4
#1 lore raw

PATCH 1/1 drivers/nvme/host/rdma.c: Fix double freeing of async event data

Quoted 4 lines · Prabhath Sajeepa

Some error paths in configuration of admin queue free data buffer associated with async request SQE without resetting the data buffer pointer to NULL, This buffer is also freed up again if the controller is shutdown or reset.

Reviewed-by Roland Dreier <roland at purestorage.com>
#2 lore raw

PATCH 1/1 drivers/nvme/host/rdma.c: Fix double freeing of async event data

In reply to Prabhath Sajeepa
Quoted 4 lines · Prabhath Sajeepa

Some error paths in configuration of admin queue free data buffer associated with async request SQE without resetting the data buffer pointer to NULL, This buffer is also freed up again if the controller is shutdown or reset.

Can you please provide a signoff?

maintainer
#4 lore raw

PATCH 1/1 drivers/nvme/host/rdma.c: Fix double freeing of async event data

Quoted 1 line · Sagi Grimberg

Can you fix the change log title to "nvme-rdma: ..." please?

And that as well, yes. Although I usually fix those bits up when applying instead of maxing a fuzz :)