From 650257e19fdb67106812b28fde772c78cfdde174 Mon Sep 17 00:00:00 2001 From: Max Gurtovoy Date: Thu, 22 Oct 2020 20:35:11 +0800 Subject: [PATCH] nvme-rdma: fix a segmentation fault during module unload mainline inclusion from mainline-v5.4-rc7 commit 9ad9e8d6ca29c1446d81c6518ae634a2141dfd22 category: bugfix bugzilla: NA CVE: NA Link: https://gitee.com/openeuler/kernel/issues/I1WGZE ------------------------------------------------- In case there are controllers that are not associated with any RDMA device (e.g. during unsuccessful reconnection) and the user will unload the module, these controllers will not be freed and will access already freed memory. The same logic appears in other fabric drivers as well. Fixes: 87fd125344d6 ("nvme-rdma: remove redundant reference between ib_device and tagset") Reviewed-by: Sagi Grimberg Signed-off-by: Max Gurtovoy Signed-off-by: Keith Busch Reviewed-by: Chao Leng Reviewed-by: Jike Cheng Signed-off-by: Ruozhu Li Signed-off-by: Lijie Reviewed-by: Tao Hou Signed-off-by: Yang Yingliang --- drivers/nvme/host/rdma.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c index d85e8df57158..cfbd7cb46637 100644 --- a/drivers/nvme/host/rdma.c +++ b/drivers/nvme/host/rdma.c @@ -2100,8 +2100,16 @@ static int __init nvme_rdma_init_module(void) static void __exit nvme_rdma_cleanup_module(void) { + struct nvme_rdma_ctrl *ctrl; + nvmf_unregister_transport(&nvme_rdma_transport); ib_unregister_client(&nvme_rdma_ib_client); + + mutex_lock(&nvme_rdma_ctrl_mutex); + list_for_each_entry(ctrl, &nvme_rdma_ctrl_list, list) + nvme_delete_ctrl(&ctrl->ctrl); + mutex_unlock(&nvme_rdma_ctrl_mutex); + flush_workqueue(nvme_delete_wq); } module_init(nvme_rdma_init_module); -- GitLab