| Message ID | 20220125200646.3002061-1-dan.aloni@vastdata.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create | expand |
Hi Anna- > On Jan 25, 2022, at 3:06 PM, Dan Aloni <dan.aloni@vastdata.com> wrote: > > If there are failures then we must not leave the non-NULL pointers with > the error value, otherwise `rpcrdma_ep_destroy` gets confused and tries > free them, resulting in an Oops. > > Signed-off-by: Dan Aloni <dan.aloni@vastdata.com> Acked-by: Chuck Lever <chuck.lever@oracle.com> > --- > net/sunrpc/xprtrdma/verbs.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c > index 3d3673ba9e1e..2a2e1514ac79 100644 > --- a/net/sunrpc/xprtrdma/verbs.c > +++ b/net/sunrpc/xprtrdma/verbs.c > @@ -436,6 +436,7 @@ static int rpcrdma_ep_create(struct rpcrdma_xprt *r_xprt) > IB_POLL_WORKQUEUE); > if (IS_ERR(ep->re_attr.send_cq)) { > rc = PTR_ERR(ep->re_attr.send_cq); > + ep->re_attr.send_cq = NULL; > goto out_destroy; > } > > @@ -444,6 +445,7 @@ static int rpcrdma_ep_create(struct rpcrdma_xprt *r_xprt) > IB_POLL_WORKQUEUE); > if (IS_ERR(ep->re_attr.recv_cq)) { > rc = PTR_ERR(ep->re_attr.recv_cq); > + ep->re_attr.recv_cq = NULL; > goto out_destroy; > } > ep->re_receive_count = 0; > @@ -482,6 +484,7 @@ static int rpcrdma_ep_create(struct rpcrdma_xprt *r_xprt) > ep->re_pd = ib_alloc_pd(device, 0); > if (IS_ERR(ep->re_pd)) { > rc = PTR_ERR(ep->re_pd); > + ep->re_pd = NULL; > goto out_destroy; > } > > -- > 2.23.0 > -- Chuck Lever
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c index 3d3673ba9e1e..2a2e1514ac79 100644 --- a/net/sunrpc/xprtrdma/verbs.c +++ b/net/sunrpc/xprtrdma/verbs.c @@ -436,6 +436,7 @@ static int rpcrdma_ep_create(struct rpcrdma_xprt *r_xprt) IB_POLL_WORKQUEUE); if (IS_ERR(ep->re_attr.send_cq)) { rc = PTR_ERR(ep->re_attr.send_cq); + ep->re_attr.send_cq = NULL; goto out_destroy; } @@ -444,6 +445,7 @@ static int rpcrdma_ep_create(struct rpcrdma_xprt *r_xprt) IB_POLL_WORKQUEUE); if (IS_ERR(ep->re_attr.recv_cq)) { rc = PTR_ERR(ep->re_attr.recv_cq); + ep->re_attr.recv_cq = NULL; goto out_destroy; } ep->re_receive_count = 0; @@ -482,6 +484,7 @@ static int rpcrdma_ep_create(struct rpcrdma_xprt *r_xprt) ep->re_pd = ib_alloc_pd(device, 0); if (IS_ERR(ep->re_pd)) { rc = PTR_ERR(ep->re_pd); + ep->re_pd = NULL; goto out_destroy; }
If there are failures then we must not leave the non-NULL pointers with the error value, otherwise `rpcrdma_ep_destroy` gets confused and tries free them, resulting in an Oops. Signed-off-by: Dan Aloni <dan.aloni@vastdata.com> --- net/sunrpc/xprtrdma/verbs.c | 3 +++ 1 file changed, 3 insertions(+)