v5.0-rc2 and NVMeOF

[bvanassche@acm.org (Bart Van Assche)]

On Tue, 2019-02-12@09:47 -0800, Paul E. McKenney wrote:
> It looks to me like you need an srcu_barrier(&head->srcu) just before
> the call to cleanup_srcu_struct_quiesced() in nvme_free_ns_head().
> Or maybe earlier in the cleanup flow, but most definitely -after- the
> last invocation of call_srcu().
> 
> Does that help?  Or is there a call to srcu_barrier() somewhere that I
> am blind to?

Hi Paul,

Even with this patch applied I still see the KASAN use-after-free warning:

diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 6a9dd68c0f4f..f2e47af6f8ee 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -391,6 +391,7 @@ static void nvme_free_ns_head(struct kref *ref)
        nvme_mpath_remove_disk(head);
        ida_simple_remove(&head->subsys->ns_ida, head->instance);
        list_del_init(&head->entry);
+       srcu_barrier(&head->srcu);
        cleanup_srcu_struct_quiesced(&head->srcu);
        nvme_put_subsystem(head->subsys);
        kfree(head);

Does that mean that I misunderstood you?

Thanks,

Bart.