* [PATCH] nvme-rdma: Fix double freeing of async event data
@ 2018-11-28 18:11 Prabhath Sajeepa
2018-11-28 18:12 ` Roland Dreier
2018-11-29 15:43 ` Christoph Hellwig
0 siblings, 2 replies; 3+ messages in thread
From: Prabhath Sajeepa @ 2018-11-28 18:11 UTC (permalink / raw)
Some error paths in configuration of admin queue free data buffer
associated with async request SQE without resetting the data buffer
pointer to NULL, This buffer is also freed up again if the controller
is shutdown or reset.
Signed-off-by: Prabhath Sajeepa <psajeepa at purestorage.com>
---
drivers/nvme/host/rdma.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index d181caf..ab6ec72 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -184,6 +184,7 @@ static int nvme_rdma_alloc_qe(struct ib_device *ibdev, struct nvme_rdma_qe *qe,
qe->dma = ib_dma_map_single(ibdev, qe->data, capsule_size, dir);
if (ib_dma_mapping_error(ibdev, qe->dma)) {
kfree(qe->data);
+ qe->data = NULL;
return -ENOMEM;
}
@@ -823,6 +824,7 @@ static int nvme_rdma_configure_admin_queue(struct nvme_rdma_ctrl *ctrl,
out_free_async_qe:
nvme_rdma_free_qe(ctrl->device->dev, &ctrl->async_event_sqe,
sizeof(struct nvme_command), DMA_TO_DEVICE);
+ ctrl->async_event_sqe.data = NULL;
out_free_queue:
nvme_rdma_free_queue(&ctrl->queues[0]);
return error;
--
2.7.4
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [PATCH] nvme-rdma: Fix double freeing of async event data
2018-11-28 18:11 [PATCH] nvme-rdma: Fix double freeing of async event data Prabhath Sajeepa
@ 2018-11-28 18:12 ` Roland Dreier
2018-11-29 15:43 ` Christoph Hellwig
1 sibling, 0 replies; 3+ messages in thread
From: Roland Dreier @ 2018-11-28 18:12 UTC (permalink / raw)
On Wed, Nov 28, 2018 at 10:11 AM Prabhath Sajeepa
<psajeepa@purestorage.com> wrote:
>
> Some error paths in configuration of admin queue free data buffer
> associated with async request SQE without resetting the data buffer
> pointer to NULL, This buffer is also freed up again if the controller
> is shutdown or reset.
>
> Signed-off-by: Prabhath Sajeepa <psajeepa at purestorage.com>
Reviewed-by: Roland Dreier <roland at purestorage.com>
> ---
> drivers/nvme/host/rdma.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
> index d181caf..ab6ec72 100644
> --- a/drivers/nvme/host/rdma.c
> +++ b/drivers/nvme/host/rdma.c
> @@ -184,6 +184,7 @@ static int nvme_rdma_alloc_qe(struct ib_device *ibdev, struct nvme_rdma_qe *qe,
> qe->dma = ib_dma_map_single(ibdev, qe->data, capsule_size, dir);
> if (ib_dma_mapping_error(ibdev, qe->dma)) {
> kfree(qe->data);
> + qe->data = NULL;
> return -ENOMEM;
> }
>
> @@ -823,6 +824,7 @@ static int nvme_rdma_configure_admin_queue(struct nvme_rdma_ctrl *ctrl,
> out_free_async_qe:
> nvme_rdma_free_qe(ctrl->device->dev, &ctrl->async_event_sqe,
> sizeof(struct nvme_command), DMA_TO_DEVICE);
> + ctrl->async_event_sqe.data = NULL;
> out_free_queue:
> nvme_rdma_free_queue(&ctrl->queues[0]);
> return error;
> --
> 2.7.4
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* [PATCH] nvme-rdma: Fix double freeing of async event data
2018-11-28 18:11 [PATCH] nvme-rdma: Fix double freeing of async event data Prabhath Sajeepa
2018-11-28 18:12 ` Roland Dreier
@ 2018-11-29 15:43 ` Christoph Hellwig
1 sibling, 0 replies; 3+ messages in thread
From: Christoph Hellwig @ 2018-11-29 15:43 UTC (permalink / raw)
Thanks,
applied to nvme-4.20.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2018-11-29 15:43 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-11-28 18:11 [PATCH] nvme-rdma: Fix double freeing of async event data Prabhath Sajeepa
2018-11-28 18:12 ` Roland Dreier
2018-11-29 15:43 ` Christoph Hellwig
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).