From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Sagi Grimberg <sagi@grimberg.me>, Chris Leech <cleech@redhat.com>,
Sasha Levin <sashal@kernel.org>,
kbusch@kernel.org, axboe@fb.com, linux-nvme@lists.infradead.org
Subject: [PATCH AUTOSEL 5.16 33/42] nvme-tcp: fix possible use-after-free in transport error_recovery work
Date: Wed, 9 Feb 2022 13:33:05 -0500 [thread overview]
Message-ID: <20220209183335.46545-33-sashal@kernel.org> (raw)
In-Reply-To: <20220209183335.46545-1-sashal@kernel.org>
From: Sagi Grimberg <sagi@grimberg.me>
[ Upstream commit ff9fc7ebf5c06de1ef72a69f9b1ab40af8b07f9e ]
While nvme_tcp_submit_async_event_work is checking the ctrl and queue
state before preparing the AER command and scheduling io_work, in order
to fully prevent a race where this check is not reliable the error
recovery work must flush async_event_work before continuing to destroy
the admin queue after setting the ctrl state to RESETTING such that
there is no race .submit_async_event and the error recovery handler
itself changing the ctrl state.
Tested-by: Chris Leech <cleech@redhat.com>
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/tcp.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
index 4ceb28675fdf6..01e24b5703dbc 100644
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -2096,6 +2096,7 @@ static void nvme_tcp_error_recovery_work(struct work_struct *work)
struct nvme_ctrl *ctrl = &tcp_ctrl->ctrl;
nvme_stop_keep_alive(ctrl);
+ flush_work(&ctrl->async_event_work);
nvme_tcp_teardown_io_queues(ctrl, false);
/* unquiesce to fail fast pending requests */
nvme_start_queues(ctrl);
--
2.34.1
next prev parent reply other threads:[~2022-02-09 18:36 UTC|newest]
Thread overview: 55+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-02-09 18:32 [PATCH AUTOSEL 5.16 01/42] ASoC: mediatek: fix unmet dependency on GPIOLIB for SND_SOC_DMIC Sasha Levin
2022-02-09 18:32 ` Sasha Levin
2022-02-09 18:32 ` Sasha Levin
2022-02-09 18:32 ` Sasha Levin
2022-02-09 18:32 ` [PATCH AUTOSEL 5.16 02/42] platform/x86: touchscreen_dmi: Add info for the RWC NANOTE P8 AY07J 2-in-1 Sasha Levin
2022-02-09 18:32 ` [PATCH AUTOSEL 5.16 03/42] platform/x86: ISST: Fix possible circular locking dependency detected Sasha Levin
2022-02-09 18:32 ` [PATCH AUTOSEL 5.16 04/42] platform/x86: amd-pmc: Correct usage of SMU version Sasha Levin
2022-02-09 18:32 ` [PATCH AUTOSEL 5.16 05/42] kunit: tool: Import missing importlib.abc Sasha Levin
2022-02-09 18:32 ` [PATCH AUTOSEL 5.16 06/42] selftests: rtc: Increase test timeout so that all tests run Sasha Levin
2022-02-09 18:32 ` [PATCH AUTOSEL 5.16 07/42] kselftest: signal all child processes Sasha Levin
2022-02-09 18:32 ` [PATCH AUTOSEL 5.16 08/42] selftests: netfilter: reduce zone stress test running time Sasha Levin
2022-02-09 18:32 ` [PATCH AUTOSEL 5.16 09/42] selftests: netfilter: check stateless nat udp checksum fixup Sasha Levin
2022-02-09 18:32 ` [PATCH AUTOSEL 5.16 10/42] net: ieee802154: at86rf230: Stop leaking skb's Sasha Levin
2022-02-09 18:32 ` [PATCH AUTOSEL 5.16 11/42] selftests/zram: Skip max_comp_streams interface on newer kernel Sasha Levin
2022-02-09 18:32 ` [PATCH AUTOSEL 5.16 12/42] selftests/zram01.sh: Fix compression ratio calculation Sasha Levin
2022-02-09 18:32 ` [PATCH AUTOSEL 5.16 13/42] selftests/zram: Adapt the situation that /dev/zram0 is being used Sasha Levin
2022-02-09 18:32 ` [PATCH AUTOSEL 5.16 14/42] selftests: openat2: Print also errno in failure messages Sasha Levin
2022-02-09 18:32 ` [PATCH AUTOSEL 5.16 15/42] selftests: openat2: Add missing dependency in Makefile Sasha Levin
2022-02-09 18:32 ` [PATCH AUTOSEL 5.16 16/42] selftests: openat2: Skip testcases that fail with EOPNOTSUPP Sasha Levin
2022-02-09 18:32 ` [PATCH AUTOSEL 5.16 17/42] selftests: skip mincore.check_file_mmap when fs lacks needed support Sasha Levin
2022-02-09 18:32 ` [PATCH AUTOSEL 5.16 18/42] ax25: improve the incomplete fix to avoid UAF and NPD bugs Sasha Levin
2022-02-09 18:32 ` [PATCH AUTOSEL 5.16 19/42] cifs: unlock chan_lock before calling cifs_put_tcp_session Sasha Levin
2022-02-09 18:32 ` [PATCH AUTOSEL 5.16 20/42] pinctrl: bcm63xx: fix unmet dependency on REGMAP for GPIO_REGMAP Sasha Levin
2022-02-09 18:32 ` [PATCH AUTOSEL 5.16 21/42] vfs: make freeze_super abort when sync_filesystem returns error Sasha Levin
2022-02-09 18:32 ` [PATCH AUTOSEL 5.16 22/42] vfs: make sync_filesystem return errors from ->sync_fs Sasha Levin
2022-02-09 18:32 ` [PATCH AUTOSEL 5.16 23/42] quota: make dquot_quota_sync " Sasha Levin
2022-02-09 18:32 ` [PATCH AUTOSEL 5.16 24/42] iommu: Fix potential use-after-free during probe Sasha Levin
2022-02-09 18:32 ` Sasha Levin
2022-02-09 18:32 ` [PATCH AUTOSEL 5.16 25/42] scsi: pm80xx: Fix double completion for SATA devices Sasha Levin
2022-02-09 18:32 ` [PATCH AUTOSEL 5.16 26/42] kselftest: Fix vdso_test_abi return status Sasha Levin
2022-02-09 18:32 ` [PATCH AUTOSEL 5.16 27/42] scsi: core: Reallocate device's budget map on queue depth change Sasha Levin
2022-02-09 18:33 ` [PATCH AUTOSEL 5.16 28/42] scsi: pm8001: Fix use-after-free for aborted TMF sas_task Sasha Levin
2022-02-09 18:33 ` [PATCH AUTOSEL 5.16 29/42] scsi: pm8001: Fix use-after-free for aborted SSP/STP sas_task Sasha Levin
2022-02-09 18:33 ` [PATCH AUTOSEL 5.16 30/42] drm/amd: Warn users about potential s0ix problems Sasha Levin
2022-02-09 18:33 ` Sasha Levin
2022-02-09 18:33 ` Sasha Levin
2022-02-09 18:33 ` [PATCH AUTOSEL 5.16 31/42] mailmap: update Christian Brauner's email address Sasha Levin
2022-02-09 18:33 ` [PATCH AUTOSEL 5.16 32/42] nvme: fix a possible use-after-free in controller reset during load Sasha Levin
2022-02-09 18:33 ` Sasha Levin [this message]
2022-02-09 18:33 ` [PATCH AUTOSEL 5.16 34/42] nvme-rdma: fix possible use-after-free in transport error_recovery work Sasha Levin
2022-02-09 18:33 ` [PATCH AUTOSEL 5.16 35/42] net: sparx5: do not refer to skb after passing it on Sasha Levin
2022-02-09 18:33 ` Sasha Levin
2022-02-09 18:33 ` [PATCH AUTOSEL 5.16 36/42] drm/amd: add support to check whether the system is set to s3 Sasha Levin
2022-02-09 18:33 ` Sasha Levin
2022-02-09 18:33 ` Sasha Levin
2022-02-09 18:33 ` [PATCH AUTOSEL 5.16 37/42] drm/amd: Only run s3 or s0ix if system is configured properly Sasha Levin
2022-02-09 18:33 ` Sasha Levin
2022-02-09 18:33 ` Sasha Levin
2022-02-09 18:33 ` [PATCH AUTOSEL 5.16 38/42] drm/amdgpu: fix logic inversion in check Sasha Levin
2022-02-09 18:33 ` Sasha Levin
2022-02-09 18:33 ` Sasha Levin
2022-02-09 18:33 ` [PATCH AUTOSEL 5.16 39/42] x86/Xen: streamline (and fix) PV CPU enumeration Sasha Levin
2022-02-09 18:33 ` [PATCH AUTOSEL 5.16 40/42] Revert "module, async: async_synchronize_full() on module init iff async is used" Sasha Levin
2022-02-09 18:33 ` [PATCH AUTOSEL 5.16 41/42] gcc-plugins/stackleak: Use noinstr in favor of notrace Sasha Levin
2022-02-09 18:33 ` [PATCH AUTOSEL 5.16 42/42] random: wake up /dev/random writers after zap Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220209183335.46545-33-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=axboe@fb.com \
--cc=cleech@redhat.com \
--cc=kbusch@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-nvme@lists.infradead.org \
--cc=sagi@grimberg.me \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.