lkml.org 
[lkml]   [2021]   [Nov]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.4 16/25] nvmet-tcp: fix a race condition between release_queue and io_work
    Date
    From: Maurizio Lombardi <mlombard@redhat.com>

    [ Upstream commit a208fc56721775987c1b86e20d86d7e0d017c0b2 ]

    If the initiator executes a reset controller operation while
    performing I/O, the target kernel will crash because of a race condition
    between release_queue and io_work;
    nvmet_tcp_uninit_data_in_cmds() may be executed while io_work
    is running, calling flush_work() was not sufficient to
    prevent this because io_work could requeue itself.

    Fix this bug by using cancel_work_sync() to prevent io_work
    from requeuing itself and set rcv_state to NVMET_TCP_RECV_ERR to
    make sure we don't receive any more data from the socket.

    Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
    Reviewed-by: Keith Busch <kbusch@kernel.org>
    Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
    Reviewed-by: John Meneghini <jmeneghi@redhat.com>
    Signed-off-by: Christoph Hellwig <hch@lst.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/nvme/target/tcp.c | 4 +++-
    1 file changed, 3 insertions(+), 1 deletion(-)

    diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
    index fac1985870765..b3e82b0889f0b 100644
    --- a/drivers/nvme/target/tcp.c
    +++ b/drivers/nvme/target/tcp.c
    @@ -1352,7 +1352,9 @@ static void nvmet_tcp_release_queue_work(struct work_struct *w)
    mutex_unlock(&nvmet_tcp_queue_mutex);

    nvmet_tcp_restore_socket_callbacks(queue);
    - flush_work(&queue->io_work);
    + cancel_work_sync(&queue->io_work);
    + /* stop accepting incoming data */
    + queue->rcv_state = NVMET_TCP_RECV_ERR;

    nvmet_tcp_uninit_data_in_cmds(queue);
    nvmet_sq_destroy(&queue->nvme_sq);
    --
    2.33.0
    \
     
     \ /
      Last update: 2021-11-30 15:56    [W:3.516 / U:0.024 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site