Commit 4ea996ce authored Nov 18, 2019 by Tomasz Zawadzki

nvmf/rdma: dont refer to rtransport when poll_group_create failed



This issue was found by code inspection.
It only occurs when pdk_nvmf_transport_poll_group_create()
itself calls spdk_nvmf_transport_poll_group_destroy().
Other transports at this time do not show this issue.

spdk_nvmf_rdma_poll_group_destroy() depends on
rgroup being assigned a transport, which is only being
done on generic nvmf layer using
spdk_nvmf_transport_poll_group_create()
after successful spdk_nvmf_rdma_poll_group_create().
When failure occurs during create, such assignment was not
performed so any references to rtransport will segfault.

Reported-by: Jacek Kalwas <jacek.kalwas@intel.com>
Signed-off-by: Tomasz Zawadzki <tomasz.zawadzki@intel.com>
Change-Id: Id54482d562bd6d7c71371306cf1de93bc05f4e8a
Reviewed-on: https://review.gerrithub.io/c/spdk/spdk/+/475002


Tested-by: SPDK CI Jenkins <sys_sgci@intel.com>
Reviewed-by: Ben Walker <benjamin.walker@intel.com>
Reviewed-by: Jim Harris <james.r.harris@intel.com>
Reviewed-by: Shuhei Matsumoto <shuhei.matsumoto.xt@hitachi.com>
Reviewed-by: Alexey Marchuk <alexeymar@mellanox.com>

parent c8ef5793

lib/nvmf/rdma.c

+9 −2

Original line number	Diff line number	Diff line
		@@ -3368,8 +3368,6 @@ spdk_nvmf_rdma_poll_group_destroy(struct spdk_nvmf_transport_poll_group *group)
		struct spdk_nvmf_rdma_transport *rtransport;

		rgroup = SPDK_CONTAINEROF(group, struct spdk_nvmf_rdma_poll_group, group);
		rtransport = SPDK_CONTAINEROF(rgroup->group.transport, struct spdk_nvmf_rdma_transport, transport);

		if (!rgroup) {
		return;
		}
		@@ -3401,6 +3399,15 @@ spdk_nvmf_rdma_poll_group_destroy(struct spdk_nvmf_transport_poll_group *group)
		free(poller);
		}

		if (rgroup->group.transport == NULL) {
		/* Transport can be NULL when spdk_nvmf_rdma_poll_group_create()
		* calls this function directly in a failure path. */
		free(rgroup);
		return;
		}

		rtransport = SPDK_CONTAINEROF(rgroup->group.transport, struct spdk_nvmf_rdma_transport, transport);

		pthread_mutex_lock(&rtransport->lock);
		next_rgroup = TAILQ_NEXT(rgroup, link);
		TAILQ_REMOVE(&rtransport->poll_groups, rgroup, link);