Linux-NVME Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH] nvme-rdma: fix crash when connect rejected
@ 2020-10-12  8:10 Chao Leng
  2020-10-13 22:25 ` Sagi Grimberg
  2020-10-15  8:10 ` Christoph Hellwig
  0 siblings, 2 replies; 3+ messages in thread
From: Chao Leng @ 2020-10-12  8:10 UTC (permalink / raw)
  To: linux-nvme; +Cc: kbusch, axboe, hch, lengchao, sagi

A crash happened when connect rejected. host establish the connect after
received ConnectReply, and then continue to send FabricsConnect.
If target do not receive ReadyToUse, host may receive ConnectReject.
Call nvme_rdma_destroy_queue_ib after host received the event of
RDMA_CM_EVENT_REJECTED. Then the command of FabricsConnect timeout,
nvme_rdma_timeout call nvme_rdma_complete_rq to fail the request.
The crash happened due to use after free in nvme_rdma_complete_rq.

nvme_rdma_destroy_queue_ib is redundant when handle the event of
RDMA_CM_EVENT_REJECTED. nvme_rdma_destroy_queue_ib is already
called in the error handling process of connection failure.

Signed-off-by: Chao Leng <lengchao@huawei.com>
---
 drivers/nvme/host/rdma.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index 9e378d0a0c01..116902b1b2c3 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -1926,7 +1926,6 @@ static int nvme_rdma_cm_handler(struct rdma_cm_id *cm_id,
 		complete(&queue->cm_done);
 		return 0;
 	case RDMA_CM_EVENT_REJECTED:
-		nvme_rdma_destroy_queue_ib(queue);
 		cm_error = nvme_rdma_conn_rejected(queue, ev);
 		break;
 	case RDMA_CM_EVENT_ROUTE_ERROR:
-- 
2.16.4


_______________________________________________
Linux-nvme mailing list
Linux-nvme@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-nvme

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH] nvme-rdma: fix crash when connect rejected
  2020-10-12  8:10 [PATCH] nvme-rdma: fix crash when connect rejected Chao Leng
@ 2020-10-13 22:25 ` Sagi Grimberg
  2020-10-15  8:10 ` Christoph Hellwig
  1 sibling, 0 replies; 3+ messages in thread
From: Sagi Grimberg @ 2020-10-13 22:25 UTC (permalink / raw)
  To: Chao Leng, linux-nvme; +Cc: kbusch, axboe, hch

Reviewed-by: Sagi Grimberg <sagi@grimberg.me>

_______________________________________________
Linux-nvme mailing list
Linux-nvme@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-nvme

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH] nvme-rdma: fix crash when connect rejected
  2020-10-12  8:10 [PATCH] nvme-rdma: fix crash when connect rejected Chao Leng
  2020-10-13 22:25 ` Sagi Grimberg
@ 2020-10-15  8:10 ` Christoph Hellwig
  1 sibling, 0 replies; 3+ messages in thread
From: Christoph Hellwig @ 2020-10-15  8:10 UTC (permalink / raw)
  To: Chao Leng; +Cc: kbusch, axboe, hch, linux-nvme, sagi

Applied to nvme-5.10, thanks.

_______________________________________________
Linux-nvme mailing list
Linux-nvme@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-nvme

^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, back to index

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-10-12  8:10 [PATCH] nvme-rdma: fix crash when connect rejected Chao Leng
2020-10-13 22:25 ` Sagi Grimberg
2020-10-15  8:10 ` Christoph Hellwig

Linux-NVME Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-nvme/0 linux-nvme/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-nvme linux-nvme/ https://lore.kernel.org/linux-nvme \
		linux-nvme@lists.infradead.org
	public-inbox-index linux-nvme

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.infradead.lists.linux-nvme


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git