summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJens Axboe <axboe@kernel.dk>2018-06-29 07:55:41 -0600
committerJens Axboe <axboe@kernel.dk>2018-06-29 07:55:41 -0600
commit49f1c61071f528ebda699ea59ab87aec3df79d4e (patch)
tree459ca8d16f209922f452cfef436da506fb6e7957
parentfad2d4ef636654e926d374ef038f4cd4286661f6 (diff)
parent682630f00a219a1b0696abe9c0967e660068187b (diff)
Merge branch 'nvme-4.18' of git://git.infradead.org/nvme into for-linus
Pull single NVMe fix from Christoph. * 'nvme-4.18' of git://git.infradead.org/nvme: nvme-rdma: fix possible double free of controller async event buffer
-rw-r--r--drivers/nvme/host/rdma.c7
1 files changed, 5 insertions, 2 deletions
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index 9544625c0b7d..518c5b09038c 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -732,8 +732,11 @@ static void nvme_rdma_destroy_admin_queue(struct nvme_rdma_ctrl *ctrl,
blk_cleanup_queue(ctrl->ctrl.admin_q);
nvme_rdma_free_tagset(&ctrl->ctrl, ctrl->ctrl.admin_tagset);
}
- nvme_rdma_free_qe(ctrl->device->dev, &ctrl->async_event_sqe,
- sizeof(struct nvme_command), DMA_TO_DEVICE);
+ if (ctrl->async_event_sqe.data) {
+ nvme_rdma_free_qe(ctrl->device->dev, &ctrl->async_event_sqe,
+ sizeof(struct nvme_command), DMA_TO_DEVICE);
+ ctrl->async_event_sqe.data = NULL;
+ }
nvme_rdma_free_queue(&ctrl->queues[0]);
}