[PATCH 0/6] nvme: fabrics and target fixes

[Guixin Liu <kanie@linux.alibaba.com>]

Six fixes found by code inspection of the nvme host and target drivers:

 - a reconnect_delay of 0 is accepted through sysfs and makes the
   ctrl_loss_tmo store divide by zero; reproduced on an unfixed
   kernel, rejected on the patched one
 - list_for_each_entry_safe() in nvme_fc_match_disconn_ls() cannot
   tolerate the rport lock drop inside the loop: the cached next
   entry may be freed in the window, so the loop switches back to a
   plain iterator, which is safe because the reference taken on the
   current entry pins it on the list; reproduced under KASAN through
   fcloop with an amplified lock-drop window
 - a data race on ctrl->transaction between concurrent per-queue
   DH-HMAC-CHAP exchanges
 - nvmet_subsys_attr_tbkas_store() walks subsys->ctrls without
   subsys->lock, the same bug fixed for qid_max_store() in patch 4
   of this series
 - nvmet_install_queue() leaks a controller reference and permanently
   wedges the queue on its error paths
 - needless GFP_ATOMIC allocations in the nvmet persistent reservation
   code

All fixes are verified on an initiator/target VM pair running the
patched kernel: 30 connect/IO/disconnect cycles, tbkas toggles racing
connection churn, persistent reservation operations across all six
reservation types, and a full DH-HMAC-CHAP authenticated session with
I/O.  The nvme-fc fix is additionally exercised through fcloop with
three controllers on one remote port, where the modified
nvme_fc_match_disconn_ls() path ran on every host- and target-initiated
association teardown, including 15 tbkas force-reconnect cycles that
send Disconnect Association LSs into the multi-entry list walk.

Guixin Liu (6):
  nvme: reject a reconnect_delay of 0 through sysfs
  nvme-fc: fix iterator over rport->ctrl_list in nvme_fc_match_disconn_ls()
  nvme-auth: fix data race on ctrl->transaction
  nvmet: take subsys->lock in nvmet_subsys_attr_tbkas_store()
  nvmet: fix controller reference leak in nvmet_install_queue() error paths
  nvmet: use GFP_KERNEL for PR allocations

 drivers/nvme/host/auth.c          | 2 +-
 drivers/nvme/host/fc.c            | 4 ++--
 drivers/nvme/host/nvme.h          | 2 +-
 drivers/nvme/host/sysfs.c         | 3 +++
 drivers/nvme/target/configfs.c    | 2 ++
 drivers/nvme/target/fabrics-cmd.c | 5 +++++
 drivers/nvme/target/pr.c          | 4 ++--
 7 files changed, 16 insertions(+), 6 deletions(-)

-- 
2.43.7