nvme-rdma: fix possible double free of controller async event buffer
authorSagi Grimberg <sagi@grimberg.me>
Mon, 25 Jun 2018 17:58:17 +0000 (20:58 +0300)
committerChristoph Hellwig <hch@lst.de>
Thu, 28 Jun 2018 14:29:54 +0000 (16:29 +0200)
commit682630f00a219a1b0696abe9c0967e660068187b
tree43a225e137266a0943308eca09fdfd62acf6638e
parent15bfd21fbc5d35834b9ea383dc458a1f0c9e3434
nvme-rdma: fix possible double free of controller async event buffer

If reconnect/reset failed where the controller async event buffer
was freed, we might end up freeing it again as we call
nvme_rdma_destroy_admin_queue again in the remove path. Given that
the sequence is guaranteed to serialize by .ctrl_stop, we simply
set ctrl->async_event_sqe.data to NULL and don't free it in future
visits.

Reported-by: Max Gurtovoy <maxg@mellanox.com>
Tested-by: Max Gurtovoy <maxg@mellanox.com>
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Christoph Hellwig <hch@lst.de>
drivers/nvme/host/rdma.c