nvme-rdma: stop admin queue before freeing it
authorJianchao Wang <jianchao.w.wang@oracle.com>
Thu, 24 May 2018 01:27:38 +0000 (09:27 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 3 Aug 2018 05:50:29 +0000 (07:50 +0200)
commit4bb1acf80c7fb05994955a26d7e40594ff6e9a9a
tree825ea8d077ee4bd5aed8a544b80c74860626b149
parent2040b0d8c9c0aa2e50b733c0ecd12d8605d8a66d
nvme-rdma: stop admin queue before freeing it

[ Upstream commit 2e050f00a0f0e07467050cb4afae0234941e5bf3 ]

For any failure after nvme_rdma_start_queue in
nvme_rdma_configure_admin_queue, the admin queue will be freed with the
NVME_RDMA_Q_LIVE flag still set.  Once nvme_rdma_stop_queue is invoked,
that will cause a use-after-free.
BUG: KASAN: use-after-free in rdma_disconnect+0x1f/0xe0 [rdma_cm]

To fix it, call nvme_rdma_stop_queue for all the failed cases after
nvme_rdma_start_queue.

Signed-off-by: Jianchao Wang <jianchao.w.wang@oracle.com>
Suggested-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Max Gurtovoy <maxg@mellanox.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/nvme/host/rdma.c