Shuhei Matsumoto b503ef4fa0 nvmf: Fix heap-use-after-free when poll_group_remove() is called after ctrlr is freed
When a qpair is destroyed and the qpair is the last,
_nvmf_ctrlr_free_from_qpair() (in lib/nvmf/nvmf.c) sends two messages,
one is for _nvmf_ctrlr_destruct() and another is for
_nvmf_transport_qpair_fini().

We do not know which of two completes earlier.

_nvmf_ctrlr_destruct() frees the qpair->ctrlr in the end.
On the other hand, _nvmf_ctrlr_free_from_qpair() calls
spdk_nvmf_poll_group_remove() in the end, and spdk_nvmf_poll_group_remove()
accesses the qpair->ctrlr to free queued requests to the qpair.

Before one recent change, spdk_nvmf_poll_group_remove() had been called
before _nvmf_ctrlr_free_from_qpair() was called.

Hence extrace the operation to free queued requests from
spdk_nvmf_poll_group_remove() and inline it into _nvmf_qpair_destroy().

Fixes one showstopper error to investigate the issue reported in #1819.

Signed-off-by: Shuhei Matsumoto <shuhei.matsumoto.xt@hitachi.com>
Change-Id: I29c43ff7b289fc77a5de9c33e0266301c412e208
Reviewed-on: https://review.spdk.io/gerrit/c/spdk/spdk/+/8438
Tested-by: SPDK CI Jenkins <sys_sgci@intel.com>
Reviewed-by: <dongx.yi@intel.com>
Reviewed-by: Aleksey Marchuk <alexeymar@mellanox.com>
Reviewed-by: Jim Harris <james.r.harris@intel.com>
Community-CI: Mellanox Build Bot
2021-06-28 16:25:24 +00:00
..
2021-02-05 14:43:47 +00:00
2021-02-05 14:43:47 +00:00
2021-02-05 14:43:47 +00:00
2021-02-05 14:43:47 +00:00
2021-06-15 08:49:10 +00:00
2021-04-26 06:55:03 +00:00
2021-02-05 14:43:47 +00:00
2021-06-22 23:42:02 +00:00
2021-02-05 14:43:47 +00:00