diff options
| author | Steve Wise <swise@opengridcomputing.com> | 2015-09-21 12:24:23 -0500 |
|---|---|---|
| committer | Anna Schumaker <Anna.Schumaker@Netapp.com> | 2015-09-28 10:42:35 -0400 |
| commit | 72c021738252dde5849d575a650239d6404930ee (patch) | |
| tree | fc04648367b5531aa8e2fa0f46492953c0e1454a /net/sunrpc/xprtrdma/transport.c | |
| parent | d0f36c46deea97bd16b9277be2f1acac74d76037 (diff) | |
| download | linux-stable-72c021738252dde5849d575a650239d6404930ee.tar.gz linux-stable-72c021738252dde5849d575a650239d6404930ee.tar.bz2 linux-stable-72c021738252dde5849d575a650239d6404930ee.zip | |
xprtrdma: disconnect and flush cqs before freeing buffers
Otherwise a FRMR completion can cause a touch-after-free crash.
In xprt_rdma_destroy(), call rpcrdma_buffer_destroy() only after calling
rpcrdma_ep_destroy().
In rpcrdma_ep_destroy(), disconnect the cm_id first which should flush the
qp, then drain the cqs, then destroy the qp, and finally destroy the cqs.
Signed-off-by: Steve Wise <swise@opengridcomputing.com>
Tested-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Diffstat (limited to 'net/sunrpc/xprtrdma/transport.c')
| -rw-r--r-- | net/sunrpc/xprtrdma/transport.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c index 64443eb754ad..41e452bc580c 100644 --- a/net/sunrpc/xprtrdma/transport.c +++ b/net/sunrpc/xprtrdma/transport.c @@ -270,8 +270,8 @@ xprt_rdma_destroy(struct rpc_xprt *xprt) xprt_clear_connected(xprt); - rpcrdma_buffer_destroy(&r_xprt->rx_buf); rpcrdma_ep_destroy(&r_xprt->rx_ep, &r_xprt->rx_ia); + rpcrdma_buffer_destroy(&r_xprt->rx_buf); rpcrdma_ia_close(&r_xprt->rx_ia); xprt_rdma_free_addresses(xprt); |