From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CA0BB26059B; Tue, 11 Nov 2025 01:00:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1762822831; cv=none; b=kUPH6ePDC5mqYdDvF+bIRX/iBmitx6fcAeGcv+ORR32Q/n9wGGphfp5JcRxkx/G2ak6UoGjUd305wWyO2pNYzg0UZj/qcaogtBMydrFxuj4oubr58rPtvaz1L9XW2WrQY3ck/UQXwPcWMkmD/cf5IU1plkTWDIoNdE/snBx6G/g= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1762822831; c=relaxed/simple; bh=Xo4QsmUql+xmmGFTyc51UIk6u58IQBNAAsmP6YTsfXk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=nPYY2XXRzEtybxYOGujFWnREK6/gSSqajpY7et/TGtWepUYX3YiHoK7t+aiMys+aM987QbHBORVr9m5YVz0iDr40pq++S9XyT8kGwLzVz7haVsMtg8I+n8xtklO81UqORv1qxpn6iz03LGknL6T8QiOLI0mgAjSZV0Ah41exBEo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=uuaC2itd; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="uuaC2itd" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 69546C16AAE; Tue, 11 Nov 2025 01:00:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1762822831; bh=Xo4QsmUql+xmmGFTyc51UIk6u58IQBNAAsmP6YTsfXk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=uuaC2itdAaHtA6APipbmuEC2qEnG1oUybYihEELEpHcULqUibWhz0xs9AOl9dkiMP gzG/VEg5VzOzJYogIx5pwSQrpO2CUm8CSNgfsn7W/NPLcbiDCrlWpTUExdioU/CYtr MZSCeEyHVNhFNrda7LlfZ0/mr8+Y54TZYim8ylI4= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Shinichiro Kawasaki , Hannes Reinecke , Daniel Wagner , Keith Busch , Sasha Levin Subject: [PATCH 6.17 179/849] nvmet-fc: avoid scheduling association deletion twice Date: Tue, 11 Nov 2025 09:35:49 +0900 Message-ID: <20251111004540.760919876@linuxfoundation.org> X-Mailer: git-send-email 2.51.2 In-Reply-To: <20251111004536.460310036@linuxfoundation.org> References: <20251111004536.460310036@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.17-stable review patch. If anyone has any objections, please let me know. ------------------ From: Daniel Wagner [ Upstream commit f2537be4f8421f6495edfa0bc284d722f253841d ] When forcefully shutting down a port via the configfs interface, nvmet_port_subsys_drop_link() first calls nvmet_port_del_ctrls() and then nvmet_disable_port(). Both functions will eventually schedule all remaining associations for deletion. The current implementation checks whether an association is about to be removed, but only after the work item has already been scheduled. As a result, it is possible for the first scheduled work item to free all resources, and then for the same work item to be scheduled again for deletion. Because the association list is an RCU list, it is not possible to take a lock and remove the list entry directly, so it cannot be looked up again. Instead, a flag (terminating) must be used to determine whether the association is already in the process of being deleted. Reported-by: Shinichiro Kawasaki Closes: https://lore.kernel.org/all/rsdinhafrtlguauhesmrrzkybpnvwantwmyfq2ih5aregghax5@mhr7v3eryci3/ Reviewed-by: Hannes Reinecke Signed-off-by: Daniel Wagner Signed-off-by: Keith Busch Signed-off-by: Sasha Levin --- drivers/nvme/target/fc.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c index 6725c34dd7c90..7d84527d5a43e 100644 --- a/drivers/nvme/target/fc.c +++ b/drivers/nvme/target/fc.c @@ -1075,6 +1075,14 @@ nvmet_fc_delete_assoc_work(struct work_struct *work) static void nvmet_fc_schedule_delete_assoc(struct nvmet_fc_tgt_assoc *assoc) { + int terminating; + + terminating = atomic_xchg(&assoc->terminating, 1); + + /* if already terminating, do nothing */ + if (terminating) + return; + nvmet_fc_tgtport_get(assoc->tgtport); if (!queue_work(nvmet_wq, &assoc->del_work)) nvmet_fc_tgtport_put(assoc->tgtport); @@ -1202,13 +1210,7 @@ nvmet_fc_delete_target_assoc(struct nvmet_fc_tgt_assoc *assoc) { struct nvmet_fc_tgtport *tgtport = assoc->tgtport; unsigned long flags; - int i, terminating; - - terminating = atomic_xchg(&assoc->terminating, 1); - - /* if already terminating, do nothing */ - if (terminating) - return; + int i; spin_lock_irqsave(&tgtport->lock, flags); list_del_rcu(&assoc->a_list); -- 2.51.0