v5.0-rc2 and NVMeOF

[paulmck@linux.ibm.com (Paul E. McKenney)]

On Tue, Feb 12, 2019@04:47:16PM -0800, Bart Van Assche wrote:
> On Tue, 2019-02-12@09:47 -0800, Paul E. McKenney wrote:
> > It looks to me like you need an srcu_barrier(&head->srcu) just before
> > the call to cleanup_srcu_struct_quiesced() in nvme_free_ns_head().
> > Or maybe earlier in the cleanup flow, but most definitely -after- the
> > last invocation of call_srcu().
> > 
> > Does that help?  Or is there a call to srcu_barrier() somewhere that I
> > am blind to?
> 
> Hi Paul,
> 
> Even with this patch applied I still see the KASAN use-after-free warning:
> 
> diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
> index 6a9dd68c0f4f..f2e47af6f8ee 100644
> --- a/drivers/nvme/host/core.c
> +++ b/drivers/nvme/host/core.c
> @@ -391,6 +391,7 @@ static void nvme_free_ns_head(struct kref *ref)
>         nvme_mpath_remove_disk(head);
>         ida_simple_remove(&head->subsys->ns_ida, head->instance);
>         list_del_init(&head->entry);
> +       srcu_barrier(&head->srcu);
>         cleanup_srcu_struct_quiesced(&head->srcu);
>         nvme_put_subsystem(head->subsys);
>         kfree(head);
> 
> Does that mean that I misunderstood you?

That is in fact what I was asking you to do.  So perhaps I misunderstood
your code.  Some questions:

1.	Are there any other places that either cleanup_srcu_struct()
	or cleanup_srcu_struct_quiesced() are invoked?  If so, it is
	possible that the others also need srcu_barrier().

2.	What prevents call_srcu() from being invoked about the
	time that cleanup_srcu_struct_quiesced() is called?

							Thanx, Paul