Commit a54a93d0 authored by Ming Lei's avatar Ming Lei Committed by Keith Busch
Browse files

nvme: move stopping keep-alive into nvme_uninit_ctrl() 



Commit 4733b65d ("nvme: start keep-alive after admin queue setup")
moves starting keep-alive from nvme_start_ctrl() into
nvme_init_ctrl_finish(), but don't move stopping keep-alive into
nvme_uninit_ctrl(), so keep-alive work can be started and keep pending
after failing to start controller, finally use-after-free is triggered if
nvme host driver is unloaded.

This patch fixes kernel panic when running nvme/004 in case that connection
failure is triggered, by moving stopping keep-alive into nvme_uninit_ctrl().

This way is reasonable because keep-alive is now started in
nvme_init_ctrl_finish().

Fixes: 3af755a4 ("nvme: move nvme_stop_keep_alive() back to original position")
Cc: Hannes Reinecke <hare@suse.de>
Cc: Mark O'Donovan <shiftee@posteo.net>
Reported-by: default avatarChanghui Zhong <czhong@redhat.com>
Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
Reviewed-by: default avatarSagi Grimberg <sagi@grimberg.me>
Reviewed-by: default avatarHannes Reinecke <hare@suse.de>
Signed-off-by: default avatarMing Lei <ming.lei@redhat.com>
Signed-off-by: default avatarKeith Busch <kbusch@kernel.org>
parent 81475beb

drivers/nvme/host/core.c

+1 −1
Original line number Diff line number Diff line
@@ -4612,7 +4612,6 @@ void nvme_stop_ctrl(struct nvme_ctrl *ctrl) 
{

	nvme_mpath_stop(ctrl);

	nvme_auth_stop(ctrl);

	nvme_stop_keep_alive(ctrl);

	nvme_stop_failfast_work(ctrl);

	flush_work(&ctrl->async_event_work);

	cancel_work_sync(&ctrl->fw_act_work);
@@ -4648,6 +4647,7 @@ EXPORT_SYMBOL_GPL(nvme_start_ctrl); 


void nvme_uninit_ctrl(struct nvme_ctrl *ctrl)

{

	nvme_stop_keep_alive(ctrl);

	nvme_hwmon_exit(ctrl);

	nvme_fault_inject_fini(&ctrl->fault_inject);

	dev_pm_qos_hide_latency_tolerance(ctrl->device);