From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-sn1nam02on0103.outbound.protection.outlook.com ([104.47.36.103]:38940 "EHLO NAM02-SN1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S933846AbeCSPsz (ORCPT ); Mon, 19 Mar 2018 11:48:55 -0400 From: Sasha Levin To: "linux-kernel@vger.kernel.org" , "stable@vger.kernel.org" CC: James Smart , James Smart , Christoph Hellwig , Sasha Levin Subject: [PATCH AUTOSEL for 4.15 063/124] nvme_fcloop: fix abort race condition Date: Mon, 19 Mar 2018 15:48:07 +0000 Message-ID: <20180319154645.11350-63-alexander.levin@microsoft.com> References: <20180319154645.11350-1-alexander.levin@microsoft.com> In-Reply-To: <20180319154645.11350-1-alexander.levin@microsoft.com> Content-Language: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org List-ID: From: James Smart [ Upstream commit 278e096063f1914fccfc77a617be9fc8dbb31b0e ] A test case revealed a race condition of an i/o completing on a thread parallel to the delete_association generating the aborts for the outstanding ios on the controller. The i/o completion was freeing the target fcloop context, thus the abort task referenced the just-freed memory. Correct by clearing the target/initiator cross pointers in the io completion and abort tasks before calling the callbacks. On aborts that detect already finished io's, ensure the complete context is called. Signed-off-by: James Smart Signed-off-by: Christoph Hellwig Signed-off-by: Sasha Levin --- drivers/nvme/target/fcloop.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/drivers/nvme/target/fcloop.c b/drivers/nvme/target/fcloop.c index bedb66521a4a..cd1adb9e7e9d 100644 --- a/drivers/nvme/target/fcloop.c +++ b/drivers/nvme/target/fcloop.c @@ -374,6 +374,7 @@ fcloop_tgt_fcprqst_done_work(struct work_struct *work) =20 spin_lock(&tfcp_req->reqlock); fcpreq =3D tfcp_req->fcpreq; + tfcp_req->fcpreq =3D NULL; spin_unlock(&tfcp_req->reqlock); =20 if (tport->remoteport && fcpreq) { @@ -615,11 +616,7 @@ fcloop_fcp_abort(struct nvme_fc_local_port *localport, =20 if (!tfcp_req) /* abort has already been called */ - return; - - if (rport->targetport) - nvmet_fc_rcv_fcp_abort(rport->targetport, - &tfcp_req->tgt_fcp_req); + goto finish; =20 /* break initiator/target relationship for io */ spin_lock(&tfcp_req->reqlock); @@ -627,6 +624,11 @@ fcloop_fcp_abort(struct nvme_fc_local_port *localport, tfcp_req->fcpreq =3D NULL; spin_unlock(&tfcp_req->reqlock); =20 + if (rport->targetport) + nvmet_fc_rcv_fcp_abort(rport->targetport, + &tfcp_req->tgt_fcp_req); + +finish: /* post the aborted io completion */ fcpreq->status =3D -ECANCELED; schedule_work(&inireq->iniwork); --=20 2.14.1