ivampiresp/Spdk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

nvmf/rdma: Don't destroy qpair if rdma_accept fails

Browse Source 
Failed qpair will be destroyed on generic nvmf layer during handling
of error code returned from spdk_nvmf_poll_group_add.
The current approach leads to heap-use-after-free.

Change-Id: I99331150fa36a3c3c18176589afb973dee449b3a
Signed-off-by: Alexey Marchuk <alexeymar@mellanox.com>
Reviewed-on: https://review.spdk.io/gerrit/c/spdk/spdk/+/3538
Community-CI: Mellanox Build Bot
Tested-by: SPDK CI Jenkins <sys_sgci@intel.com>
Reviewed-by: Ben Walker <benjamin.walker@intel.com>
Reviewed-by: Shuhei Matsumoto <shuhei.matsumoto.xt@hitachi.com>
This commit is contained in:
Alexey Marchuk 2020-07-27 21:35:11 +03:00 committed by Tomasz Zawadzki
parent 23040b8b0c
commit fdf2490a32
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
lib/nvmf/rdma.c
View File

@ -3428,7 +3428,6 @@ nvmf_rdma_qpair_reject_connection(struct spdk_nvmf_rdma_qpair *rqpair)
if (rqpair->cm_id != NULL) {
nvmf_rdma_event_reject(rqpair->cm_id, SPDK_NVMF_RDMA_ERROR_NO_RESOURCES);
}
nvmf_rdma_qpair_destroy(rqpair);
}
static int
@ -3568,6 +3567,7 @@ nvmf_rdma_close_qpair(struct spdk_nvmf_qpair *qpair)
*/
if (rqpair->qpair.state == SPDK_NVMF_QPAIR_UNINITIALIZED) {
nvmf_rdma_qpair_reject_connection(rqpair);
nvmf_rdma_qpair_destroy(rqpair);
return;
}