| Message ID | 20190107190806.GA6094@kadam (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | xprtrdma: Make rpcrdma_sendctxs_destroy() more robust | expand |
> On Jan 7, 2019, at 2:08 PM, Dan Carpenter <dan.carpenter@oracle.com> wrote: > > There was a double free in the error handling here recently. It was > a bit subtle which function was supposed to call rpcrdma_sendctxs_destroy() > so it was called in both. > > This patch makes it so we can call rpcrdma_sendctxs_destroy() twice > in a row without crashing. Belt-and-braces. I think the other patch "must" be applied, and this one "should" be applied. Reviewed-by: Chuck Lever <chuck.lever@oracle.com> > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > --- > net/sunrpc/xprtrdma/verbs.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c > index 7749a2bf6887..d05f4885548d 100644 > --- a/net/sunrpc/xprtrdma/verbs.c > +++ b/net/sunrpc/xprtrdma/verbs.c > @@ -802,9 +802,12 @@ static void rpcrdma_sendctxs_destroy(struct rpcrdma_buffer *buf) > { > unsigned long i; > > + if (!buf->rb_sc_ctxs) > + return; > for (i = 0; i <= buf->rb_sc_last; i++) > kfree(buf->rb_sc_ctxs[i]); > kfree(buf->rb_sc_ctxs); > + buf->rb_sc_ctxs = NULL; > } > > static struct rpcrdma_sendctx *rpcrdma_sendctx_create(struct rpcrdma_ia *ia) > -- > 2.17.1 > -- Chuck Lever
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c index 7749a2bf6887..d05f4885548d 100644 --- a/net/sunrpc/xprtrdma/verbs.c +++ b/net/sunrpc/xprtrdma/verbs.c @@ -802,9 +802,12 @@ static void rpcrdma_sendctxs_destroy(struct rpcrdma_buffer *buf) { unsigned long i; + if (!buf->rb_sc_ctxs) + return; for (i = 0; i <= buf->rb_sc_last; i++) kfree(buf->rb_sc_ctxs[i]); kfree(buf->rb_sc_ctxs); + buf->rb_sc_ctxs = NULL; } static struct rpcrdma_sendctx *rpcrdma_sendctx_create(struct rpcrdma_ia *ia)
There was a double free in the error handling here recently. It was a bit subtle which function was supposed to call rpcrdma_sendctxs_destroy() so it was called in both. This patch makes it so we can call rpcrdma_sendctxs_destroy() twice in a row without crashing. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- net/sunrpc/xprtrdma/verbs.c | 3 +++ 1 file changed, 3 insertions(+)