nvme: target: rdma: fix ndev refcount leak on queue connect

nvmet_rdma_queue_connect() calls nvmet_rdma_find_get_device() which
acquires a reference on the returned ndev via kref_get(). On the path
where the host queue backlog is exceeded and the function returns
NVME_SC_CONNECT_CTRL_BUSY, reference of ndev is not released, leaking
the kref.

Fix this by adding a goto to the existing put_device label before the
early return.

Fixes: 31deaeb11ba7 ("nvmet-rdma: avoid circular locking dependency on install_queue()")
Cc: stable@vger.kernel.org
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Keith Busch <kbusch@kernel.org>

diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c
index e6e2c3f9afdf57d431f10d5a0b93497e40cc910c..ac26f4f774c4de62e163ded12bded70edbab68f7 100644 (file)
--- a/drivers/nvme/target/rdma.c
+++ b/drivers/nvme/target/rdma.c
@@ -1598,8 +1598,10 @@ static int nvmet_rdma_queue_connect(struct rdma_cm_id *cm_id,
                                pending++;
                }
                mutex_unlock(&nvmet_rdma_queue_mutex);
-               if (pending > NVMET_RDMA_BACKLOG)
-                       return NVME_SC_CONNECT_CTRL_BUSY;
+               if (pending > NVMET_RDMA_BACKLOG) {
+                       ret = NVME_SC_CONNECT_CTRL_BUSY;
+                       goto put_device;
+               }
        }
 
        ret = nvmet_rdma_cm_accept(cm_id, queue, &event->param.conn);