From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B266F35BDB4; Wed, 3 Dec 2025 16:22:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764778952; cv=none; b=KlRbEtR4MJMeOoyTHyRIAPplY38zbVlD0PLoNS4l17ZP1/iUPPZGPZQmoe3/gPw3vfh3x+qTXWeTJeEEQYdgJqPQGSmFFGbQGr/QafMKsaXac9pTZ7+81X7eTOZ/UfnOcdNSNAMnVVeiLCfTW2oNUxfeuUbAl1gvJpNmUiO58aI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764778952; c=relaxed/simple; bh=gZrK1Prhg+oc344pF68mwh2kCZDeyEBWf2t51+q8j0s=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=GoTqa7bxYz5890m39yWt7fL5wyX1EEmD9GA57YCLmRG2o1KGc/rnM9kn/dCbg61g+QW0VX0KxMedPwEs3bt8TLPcTsjENP33h21KrDQ+ktoUTwwSjg4ziWqqwaRibj3WSv8ucUgCoQo4bxlgn2cc3/SmoB+gOUfDPNu2Wi4Z3T0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=PoRUlr93; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="PoRUlr93" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0095FC4CEF5; Wed, 3 Dec 2025 16:22:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1764778952; bh=gZrK1Prhg+oc344pF68mwh2kCZDeyEBWf2t51+q8j0s=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=PoRUlr93LcwKHRQ1pkK0DyXOqgfQ08Z8YGf3uf148id0m3EbnqpRMsTWR05qzhPfT PV1uV/WYC5FYrf2ECBtTdravCgga6HgM7B8zPZ0c/oSUrEGqj0UmOXxBJvfFpj972x eklTJv3p2uW+dojFZYXuprodNS/w7vVLOf71PBGY= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Shinichiro Kawasaki , Hannes Reinecke , Daniel Wagner , Keith Busch , Sasha Levin Subject: [PATCH 6.1 111/568] nvmet-fc: avoid scheduling association deletion twice Date: Wed, 3 Dec 2025 16:21:53 +0100 Message-ID: <20251203152444.802433567@linuxfoundation.org> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20251203152440.645416925@linuxfoundation.org> References: <20251203152440.645416925@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Daniel Wagner [ Upstream commit f2537be4f8421f6495edfa0bc284d722f253841d ] When forcefully shutting down a port via the configfs interface, nvmet_port_subsys_drop_link() first calls nvmet_port_del_ctrls() and then nvmet_disable_port(). Both functions will eventually schedule all remaining associations for deletion. The current implementation checks whether an association is about to be removed, but only after the work item has already been scheduled. As a result, it is possible for the first scheduled work item to free all resources, and then for the same work item to be scheduled again for deletion. Because the association list is an RCU list, it is not possible to take a lock and remove the list entry directly, so it cannot be looked up again. Instead, a flag (terminating) must be used to determine whether the association is already in the process of being deleted. Reported-by: Shinichiro Kawasaki Closes: https://lore.kernel.org/all/rsdinhafrtlguauhesmrrzkybpnvwantwmyfq2ih5aregghax5@mhr7v3eryci3/ Reviewed-by: Hannes Reinecke Signed-off-by: Daniel Wagner Signed-off-by: Keith Busch Signed-off-by: Sasha Levin --- drivers/nvme/target/fc.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c index a15e764bae35b..188b9f1bdaca1 100644 --- a/drivers/nvme/target/fc.c +++ b/drivers/nvme/target/fc.c @@ -1090,6 +1090,14 @@ nvmet_fc_delete_assoc_work(struct work_struct *work) static void nvmet_fc_schedule_delete_assoc(struct nvmet_fc_tgt_assoc *assoc) { + int terminating; + + terminating = atomic_xchg(&assoc->terminating, 1); + + /* if already terminating, do nothing */ + if (terminating) + return; + nvmet_fc_tgtport_get(assoc->tgtport); if (!queue_work(nvmet_wq, &assoc->del_work)) nvmet_fc_tgtport_put(assoc->tgtport); @@ -1209,13 +1217,7 @@ nvmet_fc_delete_target_assoc(struct nvmet_fc_tgt_assoc *assoc) { struct nvmet_fc_tgtport *tgtport = assoc->tgtport; unsigned long flags; - int i, terminating; - - terminating = atomic_xchg(&assoc->terminating, 1); - - /* if already terminating, do nothing */ - if (terminating) - return; + int i; spin_lock_irqsave(&tgtport->lock, flags); list_del_rcu(&assoc->a_list); -- 2.51.0