nvmet-rdma: update queue list during ib_device removal
authorIsrael Rukshin <israelr@mellanox.com>
Sun, 5 Nov 2017 08:43:01 +0000 (08:43 +0000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 17 Dec 2017 14:08:00 +0000 (15:08 +0100)
commit7536280f9c949a97e06381a6137412c06838c3e7
treec843dcbe84d6a83e58cb40991d5c6bf151e99378
parenta4000d951e3723d5aff6dd4ce069c5908365dc24
nvmet-rdma: update queue list during ib_device removal

[ Upstream commit 43b92fd27aaef0f529c9321cfebbaec1d7b8f503 ]

A NULL deref happens when nvmet_rdma_remove_one() is called more than once
(e.g. while connected via 2 ports).
The first call frees the queues related to the first ib_device but
doesn't remove them from the queue list.
While calling nvmet_rdma_remove_one() for the second ib_device it goes over
the full queue list again and we get the NULL deref.

Fixes: f1d4ef7d ("nvmet-rdma: register ib_client to not deadlock in device removal")
Signed-off-by: Israel Rukshin <israelr@mellanox.com>
Reviewed-by: Max Gurtovoy <maxg@mellanox.com>
Reviewed-by: Sagi Grimberg <sagi@grmberg.me>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/nvme/target/rdma.c