nvme-rdma: destroy cm id before destroy qp to avoid use after free
authorRuozhu Li <liruozhu@huawei.com>
Mon, 6 Sep 2021 03:51:34 +0000 (11:51 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 30 Sep 2021 08:11:06 +0000 (10:11 +0200)
commitecf0dc5a904830c926a64feffd8e01141f89822f
tree07672a520cff5215bffac0a763809571d0a10366
parent2a08960577af16d6ab339dafe2373aae3df7ee22
nvme-rdma: destroy cm id before destroy qp to avoid use after free

[ Upstream commit 9817d763dbe15327b9b3ff4404fa6f27f927e744 ]

We should always destroy cm_id before destroy qp to avoid to get cma
event after qp was destroyed, which may lead to use after free.
In RDMA connection establishment error flow, don't destroy qp in cm
event handler.Just report cm_error to upper level, qp will be destroy
in nvme_rdma_alloc_queue() after destroy cm id.

Signed-off-by: Ruozhu Li <liruozhu@huawei.com>
Reviewed-by: Max Gurtovoy <mgurtovoy@nvidia.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/nvme/host/rdma.c