From 3c96acb4f4c050846399380fccbfa2d1470818ae Mon Sep 17 00:00:00 2001 From: Changpeng Liu Date: Fri, 15 Jul 2016 10:19:37 +0800 Subject: [PATCH] nvmf: fix double free of session structure when exit the NVMf process Change-Id: Iea34ca82898e58633c6f7edd2ab8ff04f5484220 Signed-off-by: Changpeng Liu --- lib/nvmf/conn.c | 10 +++++++--- lib/nvmf/session.c | 4 ---- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/lib/nvmf/conn.c b/lib/nvmf/conn.c index d8f23d0d0..f989b4bef 100644 --- a/lib/nvmf/conn.c +++ b/lib/nvmf/conn.c @@ -111,13 +111,14 @@ static void spdk_nvmf_conn_do_work(void *arg) { struct spdk_nvmf_conn *conn = arg; + struct nvmf_session *session = conn->sess; /* process pending NVMe device completions */ - if (conn->sess) { + if (session) { if (conn->type == CONN_TYPE_AQ) { - nvmf_check_admin_completions(conn->sess); + nvmf_check_admin_completions(session); } else { - nvmf_check_io_completions(conn->sess); + nvmf_check_io_completions(session); } } @@ -130,6 +131,9 @@ spdk_nvmf_conn_do_work(void *arg) if (conn->state == CONN_STATE_EXITING || conn->state == CONN_STATE_FABRIC_DISCONNECT) { spdk_nvmf_conn_destruct(conn); + if (session && (session->num_connections == 0)) { + spdk_nvmf_session_destruct(session); + } } } diff --git a/lib/nvmf/session.c b/lib/nvmf/session.c index 74f74ae24..f4a2e1cd8 100644 --- a/lib/nvmf/session.c +++ b/lib/nvmf/session.c @@ -294,10 +294,6 @@ nvmf_disconnect(struct nvmf_session *session, { session->num_connections--; TAILQ_REMOVE(&session->connections, conn, link); - - if (session->num_connections == 0 || conn->type == CONN_TYPE_AQ) { - spdk_nvmf_session_destruct(session); - } } static uint64_t