target crash / host hang with nvme-all.3 branch of nvme-fabrics

[hch@lst.de ('Christoph Hellwig')]

On Mon, Jun 27, 2016@03:29:42PM -0700, Ming Lin wrote:
> root at host:~# cat loop.sh 
> #!/bin/bash
> 
> ETH=eth3
> 
> while [ 1 ] ; do
> 	ifconfig $ETH down ; sleep $(( 10 + ($RANDOM & 0x7) )); ifconfig $ETH up ;sleep $(( 10 + ($RANDOM & 0x7) ))
> done

Can you send a patch for the nvmf-selftests branch to add this test?
Thanks!

> diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c
> index 425b55c..627942c 100644
> --- a/drivers/nvme/target/rdma.c
> +++ b/drivers/nvme/target/rdma.c
> @@ -425,7 +425,15 @@ static void nvmet_rdma_free_rsps(struct nvmet_rdma_queue *queue)
>  	for (i = 0; i < nr_rsps; i++) {
>  		struct nvmet_rdma_rsp *rsp = &queue->rsps[i];
>  
> -		list_del(&rsp->free_list);
> +		/*
> +		 * Don't call "list_del(&rsp->free_list)", because:
> +		 * It could be already removed from the free list by
> +		 * nvmet_rdma_get_rsp(), or it's on the queue::rsp_wait_list
> +		 *
> +		 * It's safe we just free it because at this point the queue
> +		 * was already disconnected so nvmet_rdma_get_rsp() won't be
> +		 * called any more.
> +		 */
>  		nvmet_rdma_free_rsp(ndev, rsp);
>  	}
>  	kfree(queue->rsps);

That seems like another symptom of not flushing unsignalled requests.
At the time we call nvmet_rdma_free_rsps none of the rsp structures
should be in use.