]> git.baikalelectronics.ru Git - kernel.git/commit
nvme-rdma: avoid request double completion for concurrent nvme_rdma_timeout
authorChao Leng <lengchao@huawei.com>
Thu, 14 Jan 2021 09:09:25 +0000 (17:09 +0800)
committerChristoph Hellwig <hch@lst.de>
Mon, 18 Jan 2021 17:58:18 +0000 (18:58 +0100)
commite1d824957a9c84d04d3ece91664bfe8d5bd75773
tree2b0bef7ebfe424595f1f0c96e41be19c3343d1d2
parent45b4b209e5e1b52892ee415ccc22ad420c2e8a60
nvme-rdma: avoid request double completion for concurrent nvme_rdma_timeout

A crash happens when inject completing request long time(nearly 30s).
Each name space has a request queue, when inject completing request long
time, multi request queues may have time out requests at the same time,
nvme_rdma_timeout will execute concurrently. Multi requests in different
request queues may be queued in the same rdma queue, multi
nvme_rdma_timeout may call nvme_rdma_stop_queue at the same time.
The first nvme_rdma_timeout will clear NVME_RDMA_Q_LIVE and continue
stopping the rdma queue(drain qp), but the others check NVME_RDMA_Q_LIVE
is already cleared, and then directly complete the requests, complete
request before the qp is fully drained may lead to a use-after-free
condition.

Add a multex lock to serialize nvme_rdma_stop_queue.

Signed-off-by: Chao Leng <lengchao@huawei.com>
Tested-by: Israel Rukshin <israelr@nvidia.com>
Reviewed-by: Israel Rukshin <israelr@nvidia.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
drivers/nvme/host/rdma.c