Commit 5469bd2d authored by Alexey Marchuk's avatar Alexey Marchuk Committed by Jim Harris
Browse files

nvmf/rdma: Fix destroy of uninitialized qpair 



When rdma_accept fails we destoy a qpair immediately,
however if SRQ is disabled, qpair already posted RECV
WRs to the shared CQ. Later when we poll the CQ, we can
reap these RECV WRs while the qpair is already destroyed.
That may lead to the app crash. To fix this issue, destroy
qpair in the uninitilized state in regular way - wait for
all resources to be released

Signed-off-by: default avatarAlexey Marchuk <alexeymar@nvidia.com>
Change-Id: Iec2c0d712de981a531b3696cf43b49ef92ff6f6e
Reviewed-on: https://review.spdk.io/gerrit/c/spdk/spdk/+/25011


Community-CI: Community CI Samsung <spdk.community.ci.samsung@gmail.com>
Reviewed-by: default avatarAlex Michon <amichon@kalrayinc.com>
Reviewed-by: default avatarShuhei Matsumoto <smatsumoto@nvidia.com>
Tested-by: default avatarSPDK CI Jenkins <sys_sgci@intel.com>
Reviewed-by: default avatarJim Harris <jim.harris@nvidia.com>
Community-CI: Mellanox Build Bot
parent c7acbd6b

lib/nvmf/rdma.c

+2 −9
Original line number Diff line number Diff line
@@ -3503,7 +3503,8 @@ nvmf_rdma_destroy_drained_qpair(struct spdk_nvmf_rdma_qpair *rqpair) 
		return;

	}



	assert(rqpair->qpair.state == SPDK_NVMF_QPAIR_ERROR);

	assert(rqpair->qpair.state == SPDK_NVMF_QPAIR_UNINITIALIZED ||

	       rqpair->qpair.state == SPDK_NVMF_QPAIR_ERROR);



	nvmf_rdma_qpair_destroy(rqpair);

}
@@ -4464,17 +4465,9 @@ nvmf_rdma_close_qpair(struct spdk_nvmf_qpair *qpair, 


	rqpair->to_close = true;



	/* This happens only when the qpair is disconnected before

	 * it is added to the poll group. Since there is no poll group,

	 * the RDMA qp has not been initialized yet and the RDMA CM

	 * event has not yet been acknowledged, so we need to reject it.

	 */

	if (rqpair->qpair.state == SPDK_NVMF_QPAIR_UNINITIALIZED) {

		nvmf_rdma_qpair_reject_connection(rqpair);

		nvmf_rdma_qpair_destroy(rqpair);

		return;

	}



	if (rqpair->rdma_qp) {

		spdk_rdma_provider_qp_disconnect(rqpair->rdma_qp);

	}