Commit a9c10b5b authored by Dan Aloni's avatar Dan Aloni Committed by Anna Schumaker
Browse files

xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create 



If there are failures then we must not leave the non-NULL pointers with
the error value, otherwise `rpcrdma_ep_destroy` gets confused and tries
free them, resulting in an Oops.

Signed-off-by: default avatarDan Aloni <dan.aloni@vastdata.com>
Acked-by: default avatarChuck Lever <chuck.lever@oracle.com>
Signed-off-by: default avatarAnna Schumaker <Anna.Schumaker@Netapp.com>
parent 468d126d

net/sunrpc/xprtrdma/verbs.c

+3 −0
Original line number Diff line number Diff line
@@ -413,6 +413,7 @@ static int rpcrdma_ep_create(struct rpcrdma_xprt *r_xprt) 
					      IB_POLL_WORKQUEUE);

	if (IS_ERR(ep->re_attr.send_cq)) {

		rc = PTR_ERR(ep->re_attr.send_cq);

		ep->re_attr.send_cq = NULL;

		goto out_destroy;

	}
@@ -421,6 +422,7 @@ static int rpcrdma_ep_create(struct rpcrdma_xprt *r_xprt) 
					      IB_POLL_WORKQUEUE);

	if (IS_ERR(ep->re_attr.recv_cq)) {

		rc = PTR_ERR(ep->re_attr.recv_cq);

		ep->re_attr.recv_cq = NULL;

		goto out_destroy;

	}

	ep->re_receive_count = 0;
@@ -459,6 +461,7 @@ static int rpcrdma_ep_create(struct rpcrdma_xprt *r_xprt) 
	ep->re_pd = ib_alloc_pd(device, 0);

	if (IS_ERR(ep->re_pd)) {

		rc = PTR_ERR(ep->re_pd);

		ep->re_pd = NULL;

		goto out_destroy;

	}