On Tue, Dec 26, 2017 at 07:25:09PM +0800, Lijun Ou wrote: > + if (hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_RQ_INLINE) { > + if (hr_qp->rq_inl_buf.wqe_list) { > + kfree(hr_qp->rq_inl_buf.wqe_list[0].sg_list); > + kfree(hr_qp->rq_inl_buf.wqe_list); > + hr_qp->rq_inl_buf.wqe_list[0].sg_list = NULL; You didn't fix this use after free that Leon commented on. nulling something that is contained in something you are about to free is not at all useful. Jason -- To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html