Commit f2537be4 authored by Daniel Wagner's avatar Daniel Wagner Committed by Keith Busch
Browse files

nvmet-fc: avoid scheduling association deletion twice 



When forcefully shutting down a port via the configfs interface,
nvmet_port_subsys_drop_link() first calls nvmet_port_del_ctrls() and
then nvmet_disable_port(). Both functions will eventually schedule all
remaining associations for deletion.

The current implementation checks whether an association is about to be
removed, but only after the work item has already been scheduled. As a
result, it is possible for the first scheduled work item to free all
resources, and then for the same work item to be scheduled again for
deletion.

Because the association list is an RCU list, it is not possible to take
a lock and remove the list entry directly, so it cannot be looked up
again. Instead, a flag (terminating) must be used to determine whether
the association is already in the process of being deleted.

Reported-by: default avatarShinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
Closes: https://lore.kernel.org/all/rsdinhafrtlguauhesmrrzkybpnvwantwmyfq2ih5aregghax5@mhr7v3eryci3/


Reviewed-by: default avatarHannes Reinecke <hare@suse.de>
Signed-off-by: default avatarDaniel Wagner <wagi@kernel.org>
Signed-off-by: default avatarKeith Busch <kbusch@kernel.org>
parent db5a5406

drivers/nvme/target/fc.c

+9 −7
Original line number Diff line number Diff line
@@ -1075,6 +1075,14 @@ nvmet_fc_delete_assoc_work(struct work_struct *work) 
static void

nvmet_fc_schedule_delete_assoc(struct nvmet_fc_tgt_assoc *assoc)

{

	int terminating;



	terminating = atomic_xchg(&assoc->terminating, 1);



	/* if already terminating, do nothing */

	if (terminating)

		return;



	nvmet_fc_tgtport_get(assoc->tgtport);

	if (!queue_work(nvmet_wq, &assoc->del_work))

		nvmet_fc_tgtport_put(assoc->tgtport);
@@ -1202,13 +1210,7 @@ nvmet_fc_delete_target_assoc(struct nvmet_fc_tgt_assoc *assoc) 
{

	struct nvmet_fc_tgtport *tgtport = assoc->tgtport;

	unsigned long flags;

	int i, terminating;



	terminating = atomic_xchg(&assoc->terminating, 1);



	/* if already terminating, do nothing */

	if (terminating)

		return;

	int i;



	spin_lock_irqsave(&tgtport->lock, flags);

	list_del_rcu(&assoc->a_list);