Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f04b9cc8 authored by Sagi Grimberg's avatar Sagi Grimberg Committed by Christoph Hellwig
Browse files

nvme-rdma: Fix error status return in tagset allocation failure 



We should make sure to escelate allocation failures to prevent a
use-after-free in nvmf_create_ctrl.

Fixes: b28a308e ("nvme-rdma: move tagset allocation to a dedicated routine")
Signed-off-by: default avatarSagi Grimberg <sagi@grimberg.me>
Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
parent bd9f0759

drivers/nvme/host/rdma.c

+6 −2
Original line number Diff line number Diff line
@@ -769,8 +769,10 @@ static int nvme_rdma_configure_admin_queue(struct nvme_rdma_ctrl *ctrl, 


	if (new) {

		ctrl->ctrl.admin_tagset = nvme_rdma_alloc_tagset(&ctrl->ctrl, true);

		if (IS_ERR(ctrl->ctrl.admin_tagset))

		if (IS_ERR(ctrl->ctrl.admin_tagset)) {

			error = PTR_ERR(ctrl->ctrl.admin_tagset);

			goto out_free_queue;

		}



		ctrl->ctrl.admin_q = blk_mq_init_queue(&ctrl->admin_tag_set);

		if (IS_ERR(ctrl->ctrl.admin_q)) {
@@ -850,8 +852,10 @@ static int nvme_rdma_configure_io_queues(struct nvme_rdma_ctrl *ctrl, bool new) 


	if (new) {

		ctrl->ctrl.tagset = nvme_rdma_alloc_tagset(&ctrl->ctrl, false);

		if (IS_ERR(ctrl->ctrl.tagset))

		if (IS_ERR(ctrl->ctrl.tagset)) {

			ret = PTR_ERR(ctrl->ctrl.tagset);

			goto out_free_io_queues;

		}



		ctrl->ctrl.connect_q = blk_mq_init_queue(&ctrl->tag_set);

		if (IS_ERR(ctrl->ctrl.connect_q)) {