From mboxrd@z Thu Jan 1 00:00:00 1970 From: mlin@kernel.org (Ming Lin) Date: Tue, 12 Jul 2016 15:38:42 -0700 Subject: [PATCH] nvme-fabrics: get ctrl reference in nvmf_dev_write Message-ID: <1468363122-11073-1-git-send-email-mlin@kernel.org> From: Ming Lin Below crash was triggered when shutting down a nvme host node via 'reboot' that has 1 target device attached. That's because nvmf_dev_release() put the ctrl reference, but we didn't get the reference in nvmf_dev_write(). So the ctrl was freed in nvme_rdma_free_ctrl() before nvme_rdma_free_ring() was called. [ 88.897220] BUG: unable to handle kernel paging request at ffffebe00400f820 [ 88.905226] IP: [] kfree+0x56/0x170 [ 89.182264] Call Trace: [ 89.185899] [] nvme_rdma_free_ring.constprop.42+0x42/0xb0 [nvme_rdma] [ 89.195193] [] nvme_rdma_destroy_queue_ib+0x3a/0x60 [nvme_rdma] [ 89.203969] [] nvme_rdma_cm_handler+0x69c/0x8b6 [nvme_rdma] [ 89.212406] [] ? __slab_free+0x9b/0x2b0 [ 89.219101] [] cma_remove_one+0x1f4/0x220 [rdma_cm] [ 89.226838] [] ib_unregister_device+0xc3/0x160 [ib_core] [ 89.235008] [] mlx4_ib_remove+0x6a/0x220 [mlx4_ib] [ 89.242656] [] mlx4_remove_device+0x97/0xb0 [mlx4_core] [ 89.250732] [] mlx4_unregister_device+0x3e/0xa0 [mlx4_core] [ 89.259151] [] mlx4_unload_one+0x86/0x2f0 [mlx4_core] [ 89.267049] [] mlx4_shutdown+0x57/0x70 [mlx4_core] [ 89.274680] [] pci_device_shutdown+0x36/0x70 [ 89.281792] [] device_shutdown+0xd3/0x180 [ 89.288638] [] kernel_restart_prepare+0x36/0x40 [ 89.296003] [] kernel_restart+0x12/0x60 [ 89.302688] [] SYSC_reboot+0x1f3/0x220 [ 89.309266] [] ? __filemap_fdatawait_range+0xa8/0x150 [ 89.317151] [] ? fdatawait_one_bdev+0x20/0x20 [ 89.324335] [] ? __filemap_fdatawrite_range+0xb5/0xf0 [ 89.332227] [] ? iput+0x8a/0x200 [ 89.338294] [] ? sync_inodes_one_sb+0x20/0x20 [ 89.345465] [] ? iterate_bdevs+0x117/0x130 [ 89.352367] [] SyS_reboot+0xe/0x10 Reported-by: Steve Wise Signed-off-by: Ming Lin --- drivers/nvme/host/fabrics.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c index 1ad47c5..f13e3a6 100644 --- a/drivers/nvme/host/fabrics.c +++ b/drivers/nvme/host/fabrics.c @@ -845,6 +845,7 @@ static ssize_t nvmf_dev_write(struct file *file, const char __user *ubuf, goto out_unlock; } + kref_get(&ctrl->kref); seq_file->private = ctrl; out_unlock: -- 1.9.1