> On Jan 7, 2019, at 2:08 PM, Dan Carpenter <dan.carpenter@xxxxxxxxxx> wrote:
>
> There was a double free in the error handling here recently. It was
> a bit subtle which function was supposed to call rpcrdma_sendctxs_destroy()
> so it was called in both.
>
> This patch makes it so we can call rpcrdma_sendctxs_destroy() twice
> in a row without crashing.
Belt-and-braces. I think the other patch "must" be applied, and this
one "should" be applied.
Reviewed-by: Chuck Lever <chuck.lever@xxxxxxxxxx>
> Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
> ---
> net/sunrpc/xprtrdma/verbs.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
> index 7749a2bf6887..d05f4885548d 100644
> --- a/net/sunrpc/xprtrdma/verbs.c
> +++ b/net/sunrpc/xprtrdma/verbs.c
> @@ -802,9 +802,12 @@ static void rpcrdma_sendctxs_destroy(struct rpcrdma_buffer *buf)
> {
> unsigned long i;
>
> + if (!buf->rb_sc_ctxs)
> + return;
> for (i = 0; i <= buf->rb_sc_last; i++)
> kfree(buf->rb_sc_ctxs[i]);
> kfree(buf->rb_sc_ctxs);
> + buf->rb_sc_ctxs = NULL;
> }
>
> static struct rpcrdma_sendctx *rpcrdma_sendctx_create(struct rpcrdma_ia *ia)
> --
> 2.17.1
>
--
Chuck Lever
