Re: [PATCH] nvme-rdma: Avoid double freeing of async event data

[Christoph Hellwig]

On Mon, Mar 09, 2020 at 03:07:53PM -0600, Prabhath Sajeepa wrote:
> The timeout of identify cmd, which is invoked as part of admin queue
> creation, can result in freeing of async event data both in
> nvme_rdma_timeout handler and error handling path of
> nvme_rdma_configure_admin queue thus causing NULL pointer reference.
> Call Trace:
>  ? nvme_rdma_setup_ctrl+0x223/0x800 [nvme_rdma]
>  nvme_rdma_create_ctrl+0x2ba/0x3f7 [nvme_rdma]
>  nvmf_dev_write+0xa54/0xcc6 [nvme_fabrics]
>  __vfs_write+0x1b/0x40
>  vfs_write+0xb2/0x1b0
>  ksys_write+0x61/0xd0
>  __x64_sys_write+0x1a/0x20
>  do_syscall_64+0x60/0x1e0
>  entry_SYSCALL_64_after_hwframe+0x44/0xa9
> 
> Signed-off-by: Prabhath Sajeepa <psajeepa@xxxxxxxxxxxxxxx>
> Reviewed-by: Roland Dreier <roland@xxxxxxxxxxxxxxx>

This looks good as a hot fix:

Reviewed-by: Christoph Hellwig <hch@xxxxxx>

But I really think we need to do something about init vs timeout
in the state machine.  Otherwise we're going to deal with racing
resource deallocation forever.