Skip to contentSkip to conversation

nvme-rdma: Fix double freeing of async event data

PATCH New Prabhath Sajeepa 3 participants 3 messages Nov 28, 2018 – Nov 29, 2018 NVMe

lore
Share & tools
lore

Prabhath Sajeepa

author
#0 lore raw

PATCH 1/1 nvme-rdma: Fix double freeing of async event data

Some error paths in configuration of admin queue free data buffer associated with async request SQE without resetting the data buffer pointer to NULL, This buffer is also freed up again if the controller is shutdown or reset.

Signed-off-by Prabhath Sajeepa <psajeepa at purestorage.com>
---
 drivers/nvme/host/rdma.c | 2 ++
 1 file changed, 2 insertions(+)
drivers/nvme/host/rdma.c +2 -0
index d181caf..ab6ec72 100644
@@ -184,6 +184,7 @@ static int nvme_rdma_alloc_qe(struct ib_device *ibdev, struct nvme_rdma_qe *qe,
 	qe->dma = ib_dma_map_single(ibdev, qe->data, capsule_size, dir);
 	if (ib_dma_mapping_error(ibdev, qe->dma)) {
 		kfree(qe->data);
+		qe->data = NULL;
 		return -ENOMEM;
 	}
 

@@ -823,6 +824,7 @@ static int nvme_rdma_configure_admin_queue(struct nvme_rdma_ctrl *ctrl,
 out_free_async_qe:
 	nvme_rdma_free_qe(ctrl->device->dev, &ctrl->async_event_sqe,
 		sizeof(struct nvme_command), DMA_TO_DEVICE);
+	ctrl->async_event_sqe.data = NULL;
 out_free_queue:
 	nvme_rdma_free_queue(&ctrl->queues[0]);
 	return error;
Signature · 1 line
2.7.4
#1 lore raw

PATCH 1/1 nvme-rdma: Fix double freeing of async event data

Quoted 7 lines · Prabhath Sajeepa

Some error paths in configuration of admin queue free data buffer associated with async request SQE without resetting the data buffer pointer to NULL, This buffer is also freed up again if the controller is shutdown or reset.

Signed-off-by Prabhath Sajeepa <psajeepa at purestorage.com>
Reviewed-by Roland Dreier <roland at purestorage.com>
Quoted 27 lines
---
 drivers/nvme/host/rdma.c | 2 ++
 1 file changed, 2 insertions(+)
drivers/nvme/host/rdma.c +2 -1
index d181caf..ab6ec72 100644
@@ -184,6 +184,7 @@ static int nvme_rdma_alloc_qe(struct ib_device *ibdev, struct nvme_rdma_qe *qe,
        qe->dma = ib_dma_map_single(ibdev, qe->data, capsule_size, dir);
        if (ib_dma_mapping_error(ibdev, qe->dma)) {
                kfree(qe->data);
+               qe->data = NULL;
                return -ENOMEM;
        }
 

@@ -823,6 +824,7 @@ static int nvme_rdma_configure_admin_queue(struct nvme_rdma_ctrl *ctrl,
 out_free_async_qe:
        nvme_rdma_free_qe(ctrl->device->dev, &ctrl->async_event_sqe,
                sizeof(struct nvme_command), DMA_TO_DEVICE);
+       ctrl->async_event_sqe.data = NULL;
 out_free_queue:
        nvme_rdma_free_queue(&ctrl->queues[0]);
        return error;
--

2.7.4