From d4406d8e011e37372d6a2d06db0b25a06ca6ecd0 Mon Sep 17 00:00:00 2001 From: Sagi Grimberg Date: Thu, 22 Oct 2020 20:35:09 +0800 Subject: [PATCH] nvme-rdma: fix possible use-after-free in connect timeout mainline inclusion from mainline-v5.4-rc2 commit 67b483dd03c4cd9e90e4c3943132dce514ea4e88 category: bugfix bugzilla: NA CVE: NA Link: https://gitee.com/openeuler/kernel/issues/I1WGZE ------------------------------------------------- If the connect times out, we may have already destroyed the queue in the timeout handler, so test if the queue is still allocated in the connect error handler. Reported-by: Yi Zhang Signed-off-by: Sagi Grimberg Reviewed-by: Chao Leng Reviewed-by: Jike Cheng Signed-off-by: Ruozhu Li Signed-off-by: Lijie Reviewed-by: Tao Hou Signed-off-by: Yang Yingliang --- drivers/nvme/host/rdma.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c index d817e3b09b8b..d85e8df57158 100644 --- a/drivers/nvme/host/rdma.c +++ b/drivers/nvme/host/rdma.c @@ -599,7 +599,8 @@ static int nvme_rdma_start_queue(struct nvme_rdma_ctrl *ctrl, int idx) if (!ret) { set_bit(NVME_RDMA_Q_LIVE, &queue->flags); } else { - __nvme_rdma_stop_queue(queue); + if (test_bit(NVME_RDMA_Q_ALLOCATED, &queue->flags)) + __nvme_rdma_stop_queue(queue); dev_info(ctrl->ctrl.device, "failed to connect queue: %d ret=%d\n", idx, ret); } -- GitLab