* [PATCH] nvme-rdma: fix crash when connect rejected
@ 2020-10-12 8:10 Chao Leng
2020-10-13 22:25 ` Sagi Grimberg
2020-10-15 8:10 ` Christoph Hellwig
0 siblings, 2 replies; 3+ messages in thread
From: Chao Leng @ 2020-10-12 8:10 UTC (permalink / raw)
To: linux-nvme; +Cc: kbusch, axboe, hch, lengchao, sagi
A crash happened when connect rejected. host establish the connect after
received ConnectReply, and then continue to send FabricsConnect.
If target do not receive ReadyToUse, host may receive ConnectReject.
Call nvme_rdma_destroy_queue_ib after host received the event of
RDMA_CM_EVENT_REJECTED. Then the command of FabricsConnect timeout,
nvme_rdma_timeout call nvme_rdma_complete_rq to fail the request.
The crash happened due to use after free in nvme_rdma_complete_rq.
nvme_rdma_destroy_queue_ib is redundant when handle the event of
RDMA_CM_EVENT_REJECTED. nvme_rdma_destroy_queue_ib is already
called in the error handling process of connection failure.
Signed-off-by: Chao Leng <lengchao@huawei.com>
---
drivers/nvme/host/rdma.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index 9e378d0a0c01..116902b1b2c3 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -1926,7 +1926,6 @@ static int nvme_rdma_cm_handler(struct rdma_cm_id *cm_id,
complete(&queue->cm_done);
return 0;
case RDMA_CM_EVENT_REJECTED:
- nvme_rdma_destroy_queue_ib(queue);
cm_error = nvme_rdma_conn_rejected(queue, ev);
break;
case RDMA_CM_EVENT_ROUTE_ERROR:
--
2.16.4
_______________________________________________
Linux-nvme mailing list
Linux-nvme@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-nvme
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] nvme-rdma: fix crash when connect rejected
2020-10-12 8:10 [PATCH] nvme-rdma: fix crash when connect rejected Chao Leng
@ 2020-10-13 22:25 ` Sagi Grimberg
2020-10-15 8:10 ` Christoph Hellwig
1 sibling, 0 replies; 3+ messages in thread
From: Sagi Grimberg @ 2020-10-13 22:25 UTC (permalink / raw)
To: Chao Leng, linux-nvme; +Cc: kbusch, axboe, hch
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
_______________________________________________
Linux-nvme mailing list
Linux-nvme@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-nvme
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] nvme-rdma: fix crash when connect rejected
2020-10-12 8:10 [PATCH] nvme-rdma: fix crash when connect rejected Chao Leng
2020-10-13 22:25 ` Sagi Grimberg
@ 2020-10-15 8:10 ` Christoph Hellwig
1 sibling, 0 replies; 3+ messages in thread
From: Christoph Hellwig @ 2020-10-15 8:10 UTC (permalink / raw)
To: Chao Leng; +Cc: kbusch, axboe, hch, linux-nvme, sagi
Applied to nvme-5.10, thanks.
_______________________________________________
Linux-nvme mailing list
Linux-nvme@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-nvme
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-10-15 8:10 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-10-12 8:10 [PATCH] nvme-rdma: fix crash when connect rejected Chao Leng
2020-10-13 22:25 ` Sagi Grimberg
2020-10-15 8:10 ` Christoph Hellwig
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).