Commit fdf2490a authored Jul 27, 2020 by Alexey Marchuk Committed by Tomasz Zawadzki Aug 21, 2020

nvmf/rdma: Don't destroy qpair if rdma_accept fails



Failed qpair will be destroyed on generic nvmf layer during handling
of error code returned from spdk_nvmf_poll_group_add.
The current approach leads to heap-use-after-free.

Change-Id: I99331150fa36a3c3c18176589afb973dee449b3a
Signed-off-by: Alexey Marchuk <alexeymar@mellanox.com>
Reviewed-on: https://review.spdk.io/gerrit/c/spdk/spdk/+/3538


Community-CI: Mellanox Build Bot
Tested-by: SPDK CI Jenkins <sys_sgci@intel.com>
Reviewed-by: Ben Walker <benjamin.walker@intel.com>
Reviewed-by: Shuhei Matsumoto <shuhei.matsumoto.xt@hitachi.com>

parent 23040b8b

lib/nvmf/rdma.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -3428,7 +3428,6 @@ nvmf_rdma_qpair_reject_connection(struct spdk_nvmf_rdma_qpair *rqpair)
		if (rqpair->cm_id != NULL) {
		nvmf_rdma_event_reject(rqpair->cm_id, SPDK_NVMF_RDMA_ERROR_NO_RESOURCES);
		}
		nvmf_rdma_qpair_destroy(rqpair);
		}

		static int
		@@ -3568,6 +3567,7 @@ nvmf_rdma_close_qpair(struct spdk_nvmf_qpair *qpair)
		*/
		if (rqpair->qpair.state == SPDK_NVMF_QPAIR_UNINITIALIZED) {
		nvmf_rdma_qpair_reject_connection(rqpair);
		nvmf_rdma_qpair_destroy(rqpair);
		return;
		}