diff options
| author | Jens Axboe <axboe@kernel.dk> | 2018-06-29 07:55:41 -0600 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2018-06-29 07:55:41 -0600 |
| commit | 49f1c61071f528ebda699ea59ab87aec3df79d4e (patch) | |
| tree | 459ca8d16f209922f452cfef436da506fb6e7957 | |
| parent | fad2d4ef636654e926d374ef038f4cd4286661f6 (diff) | |
| parent | 682630f00a219a1b0696abe9c0967e660068187b (diff) | |
Merge branch 'nvme-4.18' of git://git.infradead.org/nvme into for-linus
Pull single NVMe fix from Christoph.
* 'nvme-4.18' of git://git.infradead.org/nvme:
nvme-rdma: fix possible double free of controller async event buffer
| -rw-r--r-- | drivers/nvme/host/rdma.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c index 9544625c0b7d..518c5b09038c 100644 --- a/drivers/nvme/host/rdma.c +++ b/drivers/nvme/host/rdma.c @@ -732,8 +732,11 @@ static void nvme_rdma_destroy_admin_queue(struct nvme_rdma_ctrl *ctrl, blk_cleanup_queue(ctrl->ctrl.admin_q); nvme_rdma_free_tagset(&ctrl->ctrl, ctrl->ctrl.admin_tagset); } - nvme_rdma_free_qe(ctrl->device->dev, &ctrl->async_event_sqe, - sizeof(struct nvme_command), DMA_TO_DEVICE); + if (ctrl->async_event_sqe.data) { + nvme_rdma_free_qe(ctrl->device->dev, &ctrl->async_event_sqe, + sizeof(struct nvme_command), DMA_TO_DEVICE); + ctrl->async_event_sqe.data = NULL; + } nvme_rdma_free_queue(&ctrl->queues[0]); } |