Hi Inline Below: -----Original Message----- From: Trond Myklebust [mailto:trond.myklebust@xxxxxxxxxxxxxxx] Sent: Tuesday, April 08, 2014 4:58 AM To: Devesh Sharma Cc: linux-nfs@xxxxxxxxxxxxxxx; linux-rdma@xxxxxxxxxxxxxxx Subject: Re: [PATCH] NFS-RDMA: fix qp pointer validation checks On Apr 7, 2014, at 18:30, devesh.sharma@xxxxxxxxxx wrote: > From: Devesh Sharma <devesh.sharma@xxxxxxxxxx> > > If the rdma_create_qp fails to create qp due to device firmware being > in invalid state xprtrdma still tries to destroy the non-existant qp > and ends up in a NULL pointer reference crash. > Adding proper checks for vaidating QP pointer avoids this to happen. > As far as I can see, rdma_create_qp() only sets id->qp on success. Otherwise it is left with the same value as it had on entry (i.e. NULL). What am I missing? [DS]: If you focus on rpcrdma_ep_connect() function and assume that rdma_create_qp() has failed with some valid error code, then this callback function will return ep->rep_connected = some non-zero. Eventually xprt_rdma_connect_worker() will call rpcrdma_ep_connect() again and rpcrdma_ep_connect will try to free-up all the resources, now rdma_destroy_qp() will be called with invalid QP (which is NULL) pointer And hence kernel will panic. Please correct me if I am worng. _________________________________ Trond Myklebust Linux NFS client maintainer, PrimaryData trond.myklebust@xxxxxxxxxxxxxxx -- To unsubscribe from this list: send the line "unsubscribe linux-nfs" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
