UbiquitousOS
/
OpenCloudOS-Kernel
mirror of https://gitee.com/OpenCloudOS/OpenCloudOS-Kernel.git
11
0
Fork 0
Code Issues Projects Releases Wiki Activity

xprtrdma: Double free in rpcrdma_sendctxs_create() 

The clean up is handled by the caller, rpcrdma_buffer_create(), so this
call to rpcrdma_sendctxs_destroy() leads to a double free.

Fixes: ae72950abf ("xprtrdma: Add data structure to manage RDMA Send arguments")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
This commit is contained in:
Dan Carpenter 2019-01-05 16:06:48 +03:00 committed by Anna Schumaker
parent 4429b668e0
commit 6e17f58c48
1 changed files with 1 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
net/sunrpc/xprtrdma/verbs.c
View File

@ -845,17 +845,13 @@ static int rpcrdma_sendctxs_create(struct rpcrdma_xprt *r_xprt)
for (i = 0; i <= buf->rb_sc_last; i++) { for (i = 0; i <= buf->rb_sc_last; i++) {
sc = rpcrdma_sendctx_create(&r_xprt->rx_ia); sc = rpcrdma_sendctx_create(&r_xprt->rx_ia);
if (!sc) if (!sc)
goto out_destroy; return -ENOMEM;
sc->sc_xprt = r_xprt; sc->sc_xprt = r_xprt;
buf->rb_sc_ctxs[i] = sc; buf->rb_sc_ctxs[i] = sc;
} }
return 0; return 0;
out_destroy:
rpcrdma_sendctxs_destroy(buf);
return -ENOMEM;
} }
/* The sendctx queue is not guaranteed to have a size that is a /* The sendctx queue is not guaranteed to have a size that is a