Commit 31beb3ed authored by Konrad Sztyber's avatar Konrad Sztyber Committed by Tomasz Zawadzki
Browse files

nvmf/rdma: zero out transfer_wr when freeing requests 



Otherwise, when a qpair is disconnected and pending requests are
processed in nvmf_rdma_qpair_process_pending(), stale value of this
field might be used when freeing work requests in
nvmf_rdma_request_free_data(), leading to corrupted data_wr_pool
(the pool contains the same wrs multiple times).

Fixes #3129.

Signed-off-by: default avatarKonrad Sztyber <konrad.sztyber@intel.com>
Change-Id: Id94ca463a5416de6496c9cd5ea966e9d6fe65cc4
Reviewed-on: https://review.spdk.io/gerrit/c/spdk/spdk/+/19928


Community-CI: Mellanox Build Bot
Tested-by: default avatarSPDK CI Jenkins <sys_sgci@intel.com>
Reviewed-by: default avatarTomasz Zawadzki <tomasz.zawadzki@intel.com>
Reviewed-by: default avatarAleksey Marchuk <alexeymar@nvidia.com>
parent 658c80b2

lib/nvmf/rdma.c

+1 −0
Original line number Diff line number Diff line
@@ -2011,6 +2011,7 @@ _nvmf_rdma_request_free(struct spdk_nvmf_rdma_request *rdma_req, 
	rdma_req->offset = 0;

	rdma_req->req.dif_enabled = false;

	rdma_req->fused_failed = false;

	rdma_req->transfer_wr = NULL;

	if (rdma_req->fused_pair) {

		/* This req was part of a valid fused pair, but failed before it got to

		 * READ_TO_EXECUTE state.  This means we need to fail the other request