nvme: avoid double free special payload

If a discard request needs to be retried, and that retry may fail before
a new special payload is added, a double free will result. Clear the
RQF_SPECIAL_LOAD when the request is cleaned.

Signed-off-by: Chunguang Xu <chunguang.xu@shopee.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Max Gurtovoy <mgurtovoy@nvidia.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>

diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index f5d150c62955d8e706b004ad1d9dfff93909fbd5..c40930d10bd34d0d43eb3991727269ad136d2a82 100644 (file)
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -998,6 +998,7 @@ void nvme_cleanup_cmd(struct request *req)
                        clear_bit_unlock(0, &ctrl->discard_page_busy);
                else
                        kfree(bvec_virt(&req->special_vec));
+               req->rq_flags &= ~RQF_SPECIAL_PAYLOAD;
        }
 }
 EXPORT_SYMBOL_GPL(nvme_cleanup_cmd);