Thread (3 messages) 3 messages, 1 author, 2017-03-13
DORMANTno replies

Re: [PATCH] nvmet-rdma: Fix a possible uninitialized variable dereference

From: Sagi Grimberg <hidden>
Date: 2017-03-13 13:38:20
Also in: linux-nvme

When handling a new recv command, we grab a new rsp resource and
check for the queue state being live. In case the queue is not in
live state, we simply restore the rsp back to the free list. However
in this flow we didn't set rsp->queue yet, so we cannot dereference it.

Instead, get rid of rsp->queue, because we already have rsp->cmd
reference which has a queue reference already, so use that instead.
OK this breaks the srq case. for SRQ we repost the cmd before we release
the response (which on the send completion), the cmd can later serve
a different queue so we can end up mess up if we reference
rsp->cmd->queue...

Sending a v2 to fix.
--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help