Merge branch 'nvme-4.18' of git://git.infradead.org/nvme into for-linus

Pull single NVMe fix from Christoph.

* 'nvme-4.18' of git://git.infradead.org/nvme:
  nvme-rdma: fix possible double free of controller async event buffer

1 files changed, 5 insertions, 2 deletions

diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index 9544625c0b7d..518c5b09038c 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -732,8 +732,11 @@ static void nvme_rdma_destroy_admin_queue(struct nvme_rdma_ctrl *ctrl,
                 blk_cleanup_queue(ctrl->ctrl.admin_q);
                 nvme_rdma_free_tagset(&ctrl->ctrl, ctrl->ctrl.admin_tagset);
         }
-        nvme_rdma_free_qe(ctrl->device->dev, &ctrl->async_event_sqe,
-                sizeof(struct nvme_command), DMA_TO_DEVICE);
+        if (ctrl->async_event_sqe.data) {
+                nvme_rdma_free_qe(ctrl->device->dev, &ctrl->async_event_sqe,
+                                sizeof(struct nvme_command), DMA_TO_DEVICE);
+                ctrl->async_event_sqe.data = NULL;
+        }
         nvme_rdma_free_queue(&ctrl->queues[0]);
 }