ivampiresp/Spdk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

nvmf/tcp: rm qpair destroy from poll_group_add

Browse Source 
Destroy in poll_group_add results in heap-use-after-free because
upper layer calls qpair_fini in case poll_group_add returns
error.

Signed-off-by: Jacek Kalwas <jacek.kalwas@intel.com>
Change-Id: I3e921a21b7ab5f7c15c80bc5919cb97cbda0b5d2
Reviewed-on: https://review.gerrithub.io/c/spdk/spdk/+/475858
Reviewed-by: Tomasz Zawadzki <tomasz.zawadzki@intel.com>
Reviewed-by: Ben Walker <benjamin.walker@intel.com>
Reviewed-by: Shuhei Matsumoto <shuhei.matsumoto.xt@hitachi.com>
Tested-by: SPDK CI Jenkins <sys_sgci@intel.com>
This commit is contained in:
Jacek Kalwas 2019-11-29 09:47:41 +01:00 committed by Tomasz Zawadzki
parent a68effe709
commit 155c3babce
1 changed files with 0 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
lib/nvmf/tcp.c
View File

@ -2701,28 +2701,24 @@ spdk_nvmf_tcp_poll_group_add(struct spdk_nvmf_transport_poll_group *group,
if (rc != 0) {
SPDK_ERRLOG("Could not add sock to sock_group: %s (%d)\n",
spdk_strerror(errno), errno);
spdk_nvmf_tcp_qpair_destroy(tqpair);
return -1;
}
rc = spdk_nvmf_tcp_qpair_sock_init(tqpair);
if (rc != 0) {
SPDK_ERRLOG("Cannot set sock opt for tqpair=%p\n", tqpair);
spdk_nvmf_tcp_qpair_destroy(tqpair);
return -1;
}
rc = spdk_nvmf_tcp_qpair_init(&tqpair->qpair);
if (rc < 0) {
SPDK_ERRLOG("Cannot init tqpair=%p\n", tqpair);
spdk_nvmf_tcp_qpair_destroy(tqpair);
return -1;
}
rc = spdk_nvmf_tcp_qpair_init_mem_resource(tqpair, 1);
if (rc < 0) {
SPDK_ERRLOG("Cannot init memory resource info for tqpair=%p\n", tqpair);
spdk_nvmf_tcp_qpair_destroy(tqpair);
return -1;
}