提交 a9c10b5b 编写于 作者: D Dan Aloni 提交者: Anna Schumaker

xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create

If there are failures then we must not leave the non-NULL pointers with
the error value, otherwise `rpcrdma_ep_destroy` gets confused and tries
free them, resulting in an Oops.
Signed-off-by: NDan Aloni <dan.aloni@vastdata.com>
Acked-by: NChuck Lever <chuck.lever@oracle.com>
Signed-off-by: NAnna Schumaker <Anna.Schumaker@Netapp.com>
上级 468d126d
...@@ -413,6 +413,7 @@ static int rpcrdma_ep_create(struct rpcrdma_xprt *r_xprt) ...@@ -413,6 +413,7 @@ static int rpcrdma_ep_create(struct rpcrdma_xprt *r_xprt)
IB_POLL_WORKQUEUE); IB_POLL_WORKQUEUE);
if (IS_ERR(ep->re_attr.send_cq)) { if (IS_ERR(ep->re_attr.send_cq)) {
rc = PTR_ERR(ep->re_attr.send_cq); rc = PTR_ERR(ep->re_attr.send_cq);
ep->re_attr.send_cq = NULL;
goto out_destroy; goto out_destroy;
} }
...@@ -421,6 +422,7 @@ static int rpcrdma_ep_create(struct rpcrdma_xprt *r_xprt) ...@@ -421,6 +422,7 @@ static int rpcrdma_ep_create(struct rpcrdma_xprt *r_xprt)
IB_POLL_WORKQUEUE); IB_POLL_WORKQUEUE);
if (IS_ERR(ep->re_attr.recv_cq)) { if (IS_ERR(ep->re_attr.recv_cq)) {
rc = PTR_ERR(ep->re_attr.recv_cq); rc = PTR_ERR(ep->re_attr.recv_cq);
ep->re_attr.recv_cq = NULL;
goto out_destroy; goto out_destroy;
} }
ep->re_receive_count = 0; ep->re_receive_count = 0;
...@@ -459,6 +461,7 @@ static int rpcrdma_ep_create(struct rpcrdma_xprt *r_xprt) ...@@ -459,6 +461,7 @@ static int rpcrdma_ep_create(struct rpcrdma_xprt *r_xprt)
ep->re_pd = ib_alloc_pd(device, 0); ep->re_pd = ib_alloc_pd(device, 0);
if (IS_ERR(ep->re_pd)) { if (IS_ERR(ep->re_pd)) {
rc = PTR_ERR(ep->re_pd); rc = PTR_ERR(ep->re_pd);
ep->re_pd = NULL;
goto out_destroy; goto out_destroy;
} }
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册