[PATCH 5.1 96/98] nvme-tcp: fix possible null deref on a timed out io queue connect

[Greg Kroah-Hartman]

From: Sagi Grimberg <s...@grimberg.me>

commit f34e25898a608380a60135288019c4cb6013bec8 upstream.

If I/O queue connect times out, we might have freed the queue socket
already, so check for that on the error path in nvme_tcp_start_queue.

Signed-off-by: Sagi Grimberg <s...@grimberg.me>
Signed-off-by: Christoph Hellwig <h...@lst.de>
Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---
 drivers/nvme/host/tcp.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -1423,7 +1423,8 @@ static int nvme_tcp_start_queue(struct n
        if (!ret) {
                set_bit(NVME_TCP_Q_LIVE, &ctrl->queues[idx].flags);
        } else {
-               __nvme_tcp_stop_queue(&ctrl->queues[idx]);
+               if (test_bit(NVME_TCP_Q_ALLOCATED, &ctrl->queues[idx].flags))
+                       __nvme_tcp_stop_queue(&ctrl->queues[idx]);
                dev_err(nctrl->device,
                        "failed to connect queue: %d ret=%d\n", idx, ret);
        }