Merge tag 'nfs-rdma-for-4.3-2' of git://git.linux-nfs.org/projects/anna/nfs-rdma

NFS: NFSoRDMA bugfix

Fixes a use-after-free bug.

Signed-off-by: Anna Schumaker <Anna.Schumaker@netapp.com>

2 files changed, 7 insertions, 4 deletions

diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c
index 64443eb754ad..41e452bc580c 100644
--- a/net/sunrpc/xprtrdma/transport.c
+++ b/net/sunrpc/xprtrdma/transport.c
@@ -270,8 +270,8 @@ xprt_rdma_destroy(struct rpc_xprt *xprt)
 
         xprt_clear_connected(xprt);
 
-        rpcrdma_buffer_destroy(&r_xprt->rx_buf);
         rpcrdma_ep_destroy(&r_xprt->rx_ep, &r_xprt->rx_ia);
+        rpcrdma_buffer_destroy(&r_xprt->rx_buf);
         rpcrdma_ia_close(&r_xprt->rx_ia);
 
         xprt_rdma_free_addresses(xprt);
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index eb081ad05e33..8a477e27bad7 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -755,19 +755,22 @@ rpcrdma_ep_destroy(struct rpcrdma_ep *ep, struct rpcrdma_ia *ia)
 
         cancel_delayed_work_sync(&ep->rep_connect_worker);
 
-        if (ia->ri_id->qp) {
+        if (ia->ri_id->qp)
                 rpcrdma_ep_disconnect(ep, ia);
+
+        rpcrdma_clean_cq(ep->rep_attr.recv_cq);
+        rpcrdma_clean_cq(ep->rep_attr.send_cq);
+
+        if (ia->ri_id->qp) {
                 rdma_destroy_qp(ia->ri_id);
                 ia->ri_id->qp = NULL;
         }
 
-        rpcrdma_clean_cq(ep->rep_attr.recv_cq);
         rc = ib_destroy_cq(ep->rep_attr.recv_cq);
         if (rc)
                 dprintk("RPC:       %s: ib_destroy_cq returned %i\n",
                         __func__, rc);
 
-        rpcrdma_clean_cq(ep->rep_attr.send_cq);
         rc = ib_destroy_cq(ep->rep_attr.send_cq);
         if (rc)
                 dprintk("RPC:       %s: ib_destroy_cq returned %i\n",