librdmacm: Check that send and recv CQs are different before destroying

ucma_destroy_cqs() destroys both the send and recv CQs if they
are non-null.  If the two CQs are actually the same one, this
results in a crash when trying to destroy the second CQ.  Check
that the CQs are different before destroying the second CQ.

This fixes a crash when using rsockets, which sets the send and
recv CQs to the same CQ.

Signed-off-by: Sean Hefty <sean.hefty@intel.com>

diff --git a/src/cma.c b/src/cma.c
index c32803d5640d03316d3c21ba6178ac142a6d08b3..9cd34cf592b4ab80bcb9a693d9543ef2254d19df 100755 (executable)
--- a/src/cma.c
+++ b/src/cma.c
@@ -1096,10 +1096,10 @@ static void ucma_destroy_cqs(struct rdma_cm_id *id)
        if (id->recv_cq_channel)
                ibv_destroy_comp_channel(id->recv_cq_channel);
 
-       if (id->send_cq)
+       if (id->send_cq && (id->send_cq != id->recv_cq))
                ibv_destroy_cq(id->send_cq);
 
-       if (id->send_cq_channel)
+       if (id->send_cq_channel && (id->send_cq_channel != id->recv_cq_channel))
                ibv_destroy_comp_channel(id->send_cq_channel);
 }
 

diff --git a/src/rsocket.c b/src/rsocket.c
index de0ec3e50f47d88fd649e077bf5366d43e88a4b0..01b7248dc12d5f6359af508fc0a06e08818c9f92 100644 (file)
--- a/src/rsocket.c
+++ b/src/rsocket.c
@@ -366,11 +366,8 @@ static void rs_free(struct rsocket *rs)
                rdma_dereg_mr(rs->target_mr);
 
        if (rs->cm_id) {
-               if (rs->cm_id->qp) {
-                       rs->cm_id->send_cq_channel = NULL;
-                       rs->cm_id->send_cq = NULL;
+               if (rs->cm_id->qp)
                        rdma_destroy_qp(rs->cm_id);
-               }
                rdma_destroy_id(rs->cm_id);
        }