Commit cd7db7c9 authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman

xprtrdma: Double free in rpcrdma_sendctxs_create()

[ Upstream commit 6e17f58c ]

The clean up is handled by the caller, rpcrdma_buffer_create(), so this
call to rpcrdma_sendctxs_destroy() leads to a double free.

Fixes: ae72950a ("xprtrdma: Add data structure to manage RDMA Send arguments")
Signed-off-by: 's avatarDan Carpenter <>
Reviewed-by: 's avatarChuck Lever <>
Signed-off-by: 's avatarAnna Schumaker <>
Signed-off-by: 's avatarSasha Levin <>
parent 32601a9a
......@@ -912,17 +912,13 @@ static int rpcrdma_sendctxs_create(struct rpcrdma_xprt *r_xprt)
for (i = 0; i <= buf->rb_sc_last; i++) {
sc = rpcrdma_sendctx_create(&r_xprt->rx_ia);
if (!sc)
goto out_destroy;
return -ENOMEM;
sc->sc_xprt = r_xprt;
buf->rb_sc_ctxs[i] = sc;
return 0;
return -ENOMEM;
/* The sendctx queue is not guaranteed to have a size that is a
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment