Commit 6acc26c0 authored by Alexey Marchuk's avatar Alexey Marchuk Committed by Tomasz Zawadzki
Browse files

nvmf/tcp: Fix segfault in nvmf_tcp_poll_group_create 



If any of goto labels in this function s triggered,
then nvmf_tcp_poll_group_destroy is called and last
function tries to remove the poll group from transport
groups list. But the poll group is not in the list at
this moment, so we have a segmentation fault.
To fix this issue, check if the poll group has an
assigned transport - that is done when
nvmf_tcp_poll_group_create completes. The same is
done in RDMA transport.

Signed-off-by: default avatarAlexey Marchuk <alexeymar@nvidia.com>
Reviewed-on: https://review.spdk.io/gerrit/c/spdk/spdk/+/18149

 (master)

(cherry picked from commit e744ee80)
Change-Id: I0e3125524c199de6e6e4321913f9bf2f09a56712
Signed-off-by: default avatarKrzysztof Karas <krzysztof.karas@intel.com>
Reviewed-on: https://review.spdk.io/gerrit/c/spdk/spdk/+/18379


Reviewed-by: default avatarTomasz Zawadzki <tomasz.zawadzki@intel.com>
Tested-by: default avatarSPDK CI Jenkins <sys_sgci@intel.com>
Reviewed-by: default avatarKonrad Sztyber <konrad.sztyber@intel.com>
parent 68704859

lib/nvmf/tcp.c

+8 −1
Original line number Diff line number Diff line 
/*   SPDX-License-Identifier: BSD-3-Clause

 *   Copyright (C) 2018 Intel Corporation. All rights reserved.

 *   Copyright (c) 2019, 2020 Mellanox Technologies LTD. All rights reserved.

 *   Copyright (c) 2022 NVIDIA CORPORATION & AFFILIATES. All rights reserved.

 *   Copyright (c) 2022, 2023 NVIDIA CORPORATION & AFFILIATES. All rights reserved.

 */



#include "spdk/accel.h"
@@ -1537,6 +1537,13 @@ nvmf_tcp_poll_group_destroy(struct spdk_nvmf_transport_poll_group *group) 
		spdk_put_io_channel(tgroup->accel_channel);

	}



	if (tgroup->group.transport == NULL) {

		/* Transport can be NULL when nvmf_tcp_poll_group_create()

		 * calls this function directly in a failure path. */

		free(tgroup);

		return;

	}



	ttransport = SPDK_CONTAINEROF(tgroup->group.transport, struct spdk_nvmf_tcp_transport, transport);



	next_tgroup = TAILQ_NEXT(tgroup, link);