From nobody Fri Dec 19 14:21:15 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BA7BEC6FA8F for ; Tue, 29 Aug 2023 09:14:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234438AbjH2JOQ (ORCPT ); Tue, 29 Aug 2023 05:14:16 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51684 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234489AbjH2JNr (ORCPT ); Tue, 29 Aug 2023 05:13:47 -0400 Received: from smtp-out1.suse.de (smtp-out1.suse.de [IPv6:2001:67c:2178:6::1c]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 56A441B1 for ; Tue, 29 Aug 2023 02:13:40 -0700 (PDT) Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by smtp-out1.suse.de (Postfix) with ESMTPS id B273121865; Tue, 29 Aug 2023 09:13:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_rsa; t=1693300418; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=NG1Qwe/WQzn5azjwmrwbfCg0wFPF7HJfxfYNGD1R4lU=; b=C1n8p0O15bSrHcTHtAA8ZZk0+fz+QOSAdWYxSuzrh8NIP2darW85anPSxaRzYpacGMUE/P 822CXr5PZ1kDfbrU1Ok/tMFc/Ybs7JD8YH/VxzBgRK/1pI533Jgt+iN6YwXpM68Zk4Q/cR 02g3b394hZC78jQ/srcKAlV3bTWQabs= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_ed25519; t=1693300418; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=NG1Qwe/WQzn5azjwmrwbfCg0wFPF7HJfxfYNGD1R4lU=; b=oiGZnWY4IpTAhpK4Mm7to+YCbWtJFgxB/AC8JG+HM1yFE1En13jRpTI/rbuUkCADLBdJTN S0ucFGfSxeNmdTDg== Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by imap2.suse-dmz.suse.de (Postfix) with ESMTPS id A19A813301; Tue, 29 Aug 2023 09:13:38 +0000 (UTC) Received: from dovecot-director2.suse.de ([192.168.254.65]) by imap2.suse-dmz.suse.de with ESMTPSA id 2yVbJ8K27WSwUwAAMHmgww (envelope-from ); Tue, 29 Aug 2023 09:13:38 +0000 From: Daniel Wagner To: linux-nvme@lists.infradead.org Cc: linux-kernel@vger.kernel.org, Hannes Reinecke , Sagi Grimberg , Jason Gunthorpe , James Smart , Chaitanya Kulkarni , Christoph Hellwig , Daniel Wagner Subject: [RFC v1 1/4] nvmet-trace: avoid dereferencing pointer too early Date: Tue, 29 Aug 2023 11:13:46 +0200 Message-ID: <20230829091350.16156-2-dwagner@suse.de> X-Mailer: git-send-email 2.41.0 In-Reply-To: <20230829091350.16156-1-dwagner@suse.de> References: <20230829091350.16156-1-dwagner@suse.de> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" The first command issued from the host to the target is the fabrics connect command. At this point, neither the target queue nor the controller have been allocated. But we already try to trace this command in nvmet_req_init. Reported by KASAN. Signed-off-by: Daniel Wagner Reviewed-by: Hannes Reinecke --- drivers/nvme/target/trace.c | 6 +++--- drivers/nvme/target/trace.h | 24 +++++++++++++----------- 2 files changed, 16 insertions(+), 14 deletions(-) diff --git a/drivers/nvme/target/trace.h b/drivers/nvme/target/trace.h index 6109b3806b12..6997bd7e45cf 100644 --- a/drivers/nvme/target/trace.h +++ b/drivers/nvme/target/trace.h @@ -32,18 +32,20 @@ const char *nvmet_trace_parse_fabrics_cmd(struct trace_= seq *p, u8 fctype, nvmet_trace_parse_nvm_cmd(p, opcode, cdw10) : \ nvmet_trace_parse_admin_cmd(p, opcode, cdw10))) =20 -const char *nvmet_trace_ctrl_name(struct trace_seq *p, struct nvmet_ctrl *= ctrl); -#define __print_ctrl_name(ctrl) \ - nvmet_trace_ctrl_name(p, ctrl) +const char *nvmet_trace_ctrl_id(struct trace_seq *p, u16 ctrl_id); +#define __print_ctrl_id(ctrl_id) \ + nvmet_trace_ctrl_id(p, ctrl_id) =20 const char *nvmet_trace_disk_name(struct trace_seq *p, char *name); #define __print_disk_name(name) \ nvmet_trace_disk_name(p, name) =20 #ifndef TRACE_HEADER_MULTI_READ -static inline struct nvmet_ctrl *nvmet_req_to_ctrl(struct nvmet_req *req) +static inline u16 nvmet_req_to_ctrl_id(struct nvmet_req *req) { - return req->sq->ctrl; + if (!req->sq || !req->sq->ctrl) + return 0; + return req->sq->ctrl->cntlid; } =20 static inline void __assign_req_name(char *name, struct nvmet_req *req) @@ -63,7 +65,7 @@ TRACE_EVENT(nvmet_req_init, TP_ARGS(req, cmd), TP_STRUCT__entry( __field(struct nvme_command *, cmd) - __field(struct nvmet_ctrl *, ctrl) + __field(u16, ctrl_id) __array(char, disk, DISK_NAME_LEN) __field(int, qid) __field(u16, cid) @@ -76,7 +78,7 @@ TRACE_EVENT(nvmet_req_init, ), TP_fast_assign( __entry->cmd =3D cmd; - __entry->ctrl =3D nvmet_req_to_ctrl(req); + __entry->ctrl_id =3D nvmet_req_to_ctrl_id(req); __assign_req_name(__entry->disk, req); __entry->qid =3D req->sq->qid; __entry->cid =3D cmd->common.command_id; @@ -90,7 +92,7 @@ TRACE_EVENT(nvmet_req_init, ), TP_printk("nvmet%s: %sqid=3D%d, cmdid=3D%u, nsid=3D%u, flags=3D%#x, " "meta=3D%#llx, cmd=3D(%s, %s)", - __print_ctrl_name(__entry->ctrl), + __print_ctrl_id(__entry->ctrl_id), __print_disk_name(__entry->disk), __entry->qid, __entry->cid, __entry->nsid, __entry->flags, __entry->metadata, @@ -104,7 +106,7 @@ TRACE_EVENT(nvmet_req_complete, TP_PROTO(struct nvmet_req *req), TP_ARGS(req), TP_STRUCT__entry( - __field(struct nvmet_ctrl *, ctrl) + __field(u16, ctrl_id) __array(char, disk, DISK_NAME_LEN) __field(int, qid) __field(int, cid) @@ -112,7 +114,7 @@ TRACE_EVENT(nvmet_req_complete, __field(u16, status) ), TP_fast_assign( - __entry->ctrl =3D nvmet_req_to_ctrl(req); + __entry->ctrl_id =3D nvmet_req_to_ctrl_id(req); __entry->qid =3D req->cq->qid; __entry->cid =3D req->cqe->command_id; __entry->result =3D le64_to_cpu(req->cqe->result.u64); @@ -120,7 +122,7 @@ TRACE_EVENT(nvmet_req_complete, __assign_req_name(__entry->disk, req); ), TP_printk("nvmet%s: %sqid=3D%d, cmdid=3D%u, res=3D%#llx, status=3D%#x", - __print_ctrl_name(__entry->ctrl), + __print_ctrl_id(__entry->ctrl_id), __print_disk_name(__entry->disk), __entry->qid, __entry->cid, __entry->result, __entry->status) =20 --=20 2.41.0 From nobody Fri Dec 19 14:21:15 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DB02BC83F14 for ; Tue, 29 Aug 2023 09:14:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234423AbjH2JOO (ORCPT ); Tue, 29 Aug 2023 05:14:14 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51700 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234494AbjH2JNr (ORCPT ); Tue, 29 Aug 2023 05:13:47 -0400 Received: from smtp-out2.suse.de (smtp-out2.suse.de [IPv6:2001:67c:2178:6::1d]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 90E2B1B4 for ; Tue, 29 Aug 2023 02:13:40 -0700 (PDT) Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by smtp-out2.suse.de (Postfix) with ESMTPS id 541FB1F37E; Tue, 29 Aug 2023 09:13:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_rsa; t=1693300419; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=krh7iP1jPEzQU6m6g0mCEDbOBodfhbSV73GkQQ6/CMY=; b=dXxBXujXWYB1Crh1oTOGFUjipIikfjsET1Pp/2UzKq5TBNHWmbRWk8Viilk7qUq1Mb6MPB CuroTNdOicTPmhU2sOQSQvUh3jfY/8W0yRuqPVSEWFt2qtC+OmCtYoWldoDlDbksLmRiii OIrnroiYY2tuxt45FVk/MoQ7yGWDDRM= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_ed25519; t=1693300419; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=krh7iP1jPEzQU6m6g0mCEDbOBodfhbSV73GkQQ6/CMY=; b=ohmpBxJDuiyFQ085R95QPlyPr+W8z6+kb1xPaKpxbvI6eAe2611T38bjxChoxILx/ldPtd 6xd0HlAVosyz6sCg== Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by imap2.suse-dmz.suse.de (Postfix) with ESMTPS id 45D7B13301; Tue, 29 Aug 2023 09:13:39 +0000 (UTC) Received: from dovecot-director2.suse.de ([192.168.254.65]) by imap2.suse-dmz.suse.de with ESMTPSA id 3rfmEMO27WSyUwAAMHmgww (envelope-from ); Tue, 29 Aug 2023 09:13:39 +0000 From: Daniel Wagner To: linux-nvme@lists.infradead.org Cc: linux-kernel@vger.kernel.org, Hannes Reinecke , Sagi Grimberg , Jason Gunthorpe , James Smart , Chaitanya Kulkarni , Christoph Hellwig , Daniel Wagner Subject: [RFC v1 2/4] nvmet-trace: null terminate device name string correctly Date: Tue, 29 Aug 2023 11:13:47 +0200 Message-ID: <20230829091350.16156-3-dwagner@suse.de> X-Mailer: git-send-email 2.41.0 In-Reply-To: <20230829091350.16156-1-dwagner@suse.de> References: <20230829091350.16156-1-dwagner@suse.de> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" Signed-off-by: Daniel Wagner Reviewed-by: Hannes Reinecke --- drivers/nvme/target/trace.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/nvme/target/trace.h b/drivers/nvme/target/trace.h index 6997bd7e45cf..9ba466b49613 100644 --- a/drivers/nvme/target/trace.h +++ b/drivers/nvme/target/trace.h @@ -55,8 +55,8 @@ static inline void __assign_req_name(char *name, struct n= vmet_req *req) return; } =20 - strncpy(name, req->ns->device_path, - min_t(size_t, DISK_NAME_LEN, strlen(req->ns->device_path))); + strscpy(name, req->ns->device_path, + min_t(size_t, DISK_NAME_LEN, strlen(req->ns->device_path) + 1)); } #endif =20 --=20 2.41.0 From nobody Fri Dec 19 14:21:15 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 04B1AC83F1B for ; Tue, 29 Aug 2023 09:14:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234482AbjH2JOS (ORCPT ); Tue, 29 Aug 2023 05:14:18 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51728 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234495AbjH2JNs (ORCPT ); Tue, 29 Aug 2023 05:13:48 -0400 Received: from smtp-out1.suse.de (smtp-out1.suse.de [195.135.220.28]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5659618D for ; Tue, 29 Aug 2023 02:13:41 -0700 (PDT) Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by smtp-out1.suse.de (Postfix) with ESMTPS id 05CBC21868; Tue, 29 Aug 2023 09:13:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_rsa; t=1693300420; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=tbnmeXqaEy+q0x7z5j9bg8512I9Cw52vyXZSyNRCyQs=; b=Byp/JQdjZlwtUrTt+pz4U9LPs9CX1CH3jPaE7wG/i2MGQGK5wZKC60tDdGLthjQQUt3+Zo 1M0s6mQTReANnTfF1qsjluPUbDBKgB77RRW6asR+JFMeTgsCAAVKsv6yZikPsHVmUOmz6S f97BLSyw67Fpg5AO+M+agsIvUJI4XpI= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_ed25519; t=1693300420; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=tbnmeXqaEy+q0x7z5j9bg8512I9Cw52vyXZSyNRCyQs=; b=Yg0tbqWx3cZ/OYwzYMgTD5YdiaRZQpS0EPBdj09gmJiewF/5XK+njonGN2VLt9Vkae8vLH 4B2tA4bODzhnrNBw== Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by imap2.suse-dmz.suse.de (Postfix) with ESMTPS id EB63E13301; Tue, 29 Aug 2023 09:13:39 +0000 (UTC) Received: from dovecot-director2.suse.de ([192.168.254.65]) by imap2.suse-dmz.suse.de with ESMTPSA id 469wOcO27WS0UwAAMHmgww (envelope-from ); Tue, 29 Aug 2023 09:13:39 +0000 From: Daniel Wagner To: linux-nvme@lists.infradead.org Cc: linux-kernel@vger.kernel.org, Hannes Reinecke , Sagi Grimberg , Jason Gunthorpe , James Smart , Chaitanya Kulkarni , Christoph Hellwig , Daniel Wagner Subject: [RFC v1 3/4] nvmet-fc: untangle cross refcounting objects Date: Tue, 29 Aug 2023 11:13:48 +0200 Message-ID: <20230829091350.16156-4-dwagner@suse.de> X-Mailer: git-send-email 2.41.0 In-Reply-To: <20230829091350.16156-1-dwagner@suse.de> References: <20230829091350.16156-1-dwagner@suse.de> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" Associations take a refcount on queues, queues take a refcount on associations. The existing code lead to the situation that the target executes a disconnect and the host retriggers a reconnect immediately. The reconnect command still finds an existing association and uses this. Though the reconnect crashes later on because nvmet_fc_delete_target_assoc() blindly goes ahead and removes resources while the reconnect code wants to use it. The problem is that nvmet_fc_find_target_assoc() is able to lookup an association which is beeing removed. So the first thing to address nvmet_fc_find_target_queue() is to remove the association out of the list and wait a RCU cycle and free resources in the free function callback of the kref_put(). The live time of the queues are strictly bound to the lifetime of an association. Thus we don't need to take reverse refcounts (queue -> assocation). Furthermore, streamline the cleanup code by using the workqueue for delete the association in nvmet_fc_ls_disconnect. This ensures, that we run throught the same shutdown path in all non error cases. Reproducer: nvme/003 Signed-off-by: Daniel Wagner --- drivers/nvme/target/fc.c | 67 ++++++++++++++++++++-------------------- 1 file changed, 33 insertions(+), 34 deletions(-) diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c index df7d84aff843..9d7262a8e3db 100644 --- a/drivers/nvme/target/fc.c +++ b/drivers/nvme/target/fc.c @@ -165,6 +165,7 @@ struct nvmet_fc_tgt_assoc { struct nvmet_fc_hostport *hostport; struct nvmet_fc_ls_iod *rcv_disconn; struct list_head a_list; + struct nvmet_fc_tgt_queue *_queues[NVMET_NR_QUEUES + 1]; struct nvmet_fc_tgt_queue __rcu *queues[NVMET_NR_QUEUES + 1]; struct kref ref; struct work_struct del_work; @@ -802,14 +803,11 @@ nvmet_fc_alloc_target_queue(struct nvmet_fc_tgt_assoc= *assoc, if (!queue) return NULL; =20 - if (!nvmet_fc_tgt_a_get(assoc)) - goto out_free_queue; - queue->work_q =3D alloc_workqueue("ntfc%d.%d.%d", 0, 0, assoc->tgtport->fc_target_port.port_num, assoc->a_id, qid); if (!queue->work_q) - goto out_a_put; + goto out_free_queue; =20 queue->qid =3D qid; queue->sqsize =3D sqsize; @@ -830,7 +828,8 @@ nvmet_fc_alloc_target_queue(struct nvmet_fc_tgt_assoc *= assoc, if (ret) goto out_fail_iodlist; =20 - WARN_ON(assoc->queues[qid]); + WARN_ON(assoc->_queues[qid]); + assoc->_queues[qid] =3D queue; rcu_assign_pointer(assoc->queues[qid], queue); =20 return queue; @@ -838,8 +837,6 @@ nvmet_fc_alloc_target_queue(struct nvmet_fc_tgt_assoc *= assoc, out_fail_iodlist: nvmet_fc_destroy_fcp_iodlist(assoc->tgtport, queue); destroy_workqueue(queue->work_q); -out_a_put: - nvmet_fc_tgt_a_put(assoc); out_free_queue: kfree(queue); return NULL; @@ -852,12 +849,8 @@ nvmet_fc_tgt_queue_free(struct kref *ref) struct nvmet_fc_tgt_queue *queue =3D container_of(ref, struct nvmet_fc_tgt_queue, ref); =20 - rcu_assign_pointer(queue->assoc->queues[queue->qid], NULL); - nvmet_fc_destroy_fcp_iodlist(queue->assoc->tgtport, queue); =20 - nvmet_fc_tgt_a_put(queue->assoc); - destroy_workqueue(queue->work_q); =20 kfree_rcu(queue, rcu); @@ -1100,6 +1093,11 @@ nvmet_fc_delete_assoc(struct work_struct *work) container_of(work, struct nvmet_fc_tgt_assoc, del_work); =20 nvmet_fc_delete_target_assoc(assoc); + + /* release get taken in nvmet_fc_find_target_assoc */ + nvmet_fc_tgt_a_put(assoc); + + /* final reference from nvmet_fc_ls_create_association */ nvmet_fc_tgt_a_put(assoc); } =20 @@ -1172,13 +1170,18 @@ nvmet_fc_target_assoc_free(struct kref *ref) struct nvmet_fc_tgtport *tgtport =3D assoc->tgtport; struct nvmet_fc_ls_iod *oldls; unsigned long flags; + int i; + + for (i =3D NVMET_NR_QUEUES; i >=3D 0; i--) { + if (assoc->_queues[i]) + nvmet_fc_delete_target_queue(assoc->_queues[i]); + } =20 /* Send Disconnect now that all i/o has completed */ nvmet_fc_xmt_disconnect_assoc(assoc); =20 nvmet_fc_free_hostport(assoc->hostport); spin_lock_irqsave(&tgtport->lock, flags); - list_del_rcu(&assoc->a_list); oldls =3D assoc->rcv_disconn; spin_unlock_irqrestore(&tgtport->lock, flags); /* if pending Rcv Disconnect Association LS, send rsp now */ @@ -1208,7 +1211,6 @@ static void nvmet_fc_delete_target_assoc(struct nvmet_fc_tgt_assoc *assoc) { struct nvmet_fc_tgtport *tgtport =3D assoc->tgtport; - struct nvmet_fc_tgt_queue *queue; int i, terminating; =20 terminating =3D atomic_xchg(&assoc->terminating, 1); @@ -1217,29 +1219,21 @@ nvmet_fc_delete_target_assoc(struct nvmet_fc_tgt_as= soc *assoc) if (terminating) return; =20 + /* prevent new I/Os entering the queues */ + for (i =3D NVMET_NR_QUEUES; i >=3D 0; i--) + rcu_assign_pointer(assoc->queues[i], NULL); + list_del_rcu(&assoc->a_list); + synchronize_rcu(); =20 + /* ensure all in-flight I/Os have been processed */ for (i =3D NVMET_NR_QUEUES; i >=3D 0; i--) { - rcu_read_lock(); - queue =3D rcu_dereference(assoc->queues[i]); - if (!queue) { - rcu_read_unlock(); - continue; - } - - if (!nvmet_fc_tgt_q_get(queue)) { - rcu_read_unlock(); - continue; - } - rcu_read_unlock(); - nvmet_fc_delete_target_queue(queue); - nvmet_fc_tgt_q_put(queue); + if (assoc->_queues[i]) + flush_workqueue(assoc->_queues[i]->work_q); } =20 dev_info(tgtport->dev, "{%d:%d} Association deleted\n", tgtport->fc_target_port.port_num, assoc->a_id); - - nvmet_fc_tgt_a_put(assoc); } =20 static struct nvmet_fc_tgt_assoc * @@ -1497,6 +1491,8 @@ __nvmet_fc_free_assocs(struct nvmet_fc_tgtport *tgtpo= rt) nvmet_fc_tgt_a_put(assoc); } rcu_read_unlock(); + + flush_workqueue(nvmet_wq); } =20 /** @@ -1870,9 +1866,6 @@ nvmet_fc_ls_disconnect(struct nvmet_fc_tgtport *tgtpo= rt, sizeof(struct fcnvme_ls_disconnect_assoc_acc)), FCNVME_LS_DISCONNECT_ASSOC); =20 - /* release get taken in nvmet_fc_find_target_assoc */ - nvmet_fc_tgt_a_put(assoc); - /* * The rules for LS response says the response cannot * go back until ABTS's have been sent for all outstanding @@ -1887,8 +1880,6 @@ nvmet_fc_ls_disconnect(struct nvmet_fc_tgtport *tgtpo= rt, assoc->rcv_disconn =3D iod; spin_unlock_irqrestore(&tgtport->lock, flags); =20 - nvmet_fc_delete_target_assoc(assoc); - if (oldls) { dev_info(tgtport->dev, "{%d:%d} Multiple Disconnect Association LS's " @@ -1904,6 +1895,11 @@ nvmet_fc_ls_disconnect(struct nvmet_fc_tgtport *tgtp= ort, nvmet_fc_xmt_ls_rsp(tgtport, oldls); } =20 + if (!queue_work(nvmet_wq, &assoc->del_work)) { + /* already deleting - release local reference */ + nvmet_fc_tgt_a_put(assoc); + } + return false; } =20 @@ -2933,6 +2929,9 @@ static int __init nvmet_fc_init_module(void) =20 static void __exit nvmet_fc_exit_module(void) { + /* ensure any shutdown operation, e.g. delete ctrls have finished */ + flush_workqueue(nvmet_wq); + /* sanity check - all lports should be removed */ if (!list_empty(&nvmet_fc_target_list)) pr_warn("%s: targetport list not empty\n", __func__); --=20 2.41.0 From nobody Fri Dec 19 14:21:15 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CB56BC83F16 for ; Tue, 29 Aug 2023 09:14:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234495AbjH2JOU (ORCPT ); Tue, 29 Aug 2023 05:14:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51734 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234497AbjH2JNu (ORCPT ); Tue, 29 Aug 2023 05:13:50 -0400 Received: from smtp-out1.suse.de (smtp-out1.suse.de [195.135.220.28]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 73D7F19A for ; Tue, 29 Aug 2023 02:13:42 -0700 (PDT) Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by smtp-out1.suse.de (Postfix) with ESMTPS id 2941C2186B; Tue, 29 Aug 2023 09:13:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_rsa; t=1693300421; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=eB9aR/U6RXS2ICVTlyDomYJuoXmtN3u/uV5XxMcbYuo=; b=Hpqoevjysf1nd1SZYQ6aepWzFXEDTEdcxmvOBeF5UIf0r8QPknKN+mUMTvOZ2/LSGc8AAw /blVeYyProyUL7FHWzfrc5NhTu7m4nt7aaRokpcYAMq3KUjEBUBoKSoEgjj9hZzS7eygKM h6D+VFqdaFS67jUdWMnHmKZz1q8Y2ak= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_ed25519; t=1693300421; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=eB9aR/U6RXS2ICVTlyDomYJuoXmtN3u/uV5XxMcbYuo=; b=zxhdbhswoF+xnBjjhQZNxrT9am2KXkHQKth4H71nz1YFuqG+xMydTqyjpGcwLs8ZPmh9VP D0eBxqpIySVuyGDQ== Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by imap2.suse-dmz.suse.de (Postfix) with ESMTPS id 1CFD913301; Tue, 29 Aug 2023 09:13:41 +0000 (UTC) Received: from dovecot-director2.suse.de ([192.168.254.65]) by imap2.suse-dmz.suse.de with ESMTPSA id irPtBsW27WS8UwAAMHmgww (envelope-from ); Tue, 29 Aug 2023 09:13:41 +0000 From: Daniel Wagner To: linux-nvme@lists.infradead.org Cc: linux-kernel@vger.kernel.org, Hannes Reinecke , Sagi Grimberg , Jason Gunthorpe , James Smart , Chaitanya Kulkarni , Christoph Hellwig , Daniel Wagner Subject: [RFC v1 4/4] nvmet-discovery: Do not use invalid port Date: Tue, 29 Aug 2023 11:13:50 +0200 Message-ID: <20230829091350.16156-6-dwagner@suse.de> X-Mailer: git-send-email 2.41.0 In-Reply-To: <20230829091350.16156-1-dwagner@suse.de> References: <20230829091350.16156-1-dwagner@suse.de> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" The port entry binding might not be existing and thus the req->port pointer is not valid. Reproducer: nvme/005 with active system nvmf-autoconnect systemd service. Signed-off-by: Daniel Wagner --- drivers/nvme/target/discovery.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/nvme/target/discovery.c b/drivers/nvme/target/discover= y.c index 668d257fa986..fc113057cb95 100644 --- a/drivers/nvme/target/discovery.c +++ b/drivers/nvme/target/discovery.c @@ -191,6 +191,15 @@ static void nvmet_execute_disc_get_log_page(struct nvm= et_req *req) goto out; } =20 + + /* No port assigned, portentrybinding is missing */ + if (!req->port) { + req->error_loc =3D + offsetof(struct nvme_get_log_page_command, lpo); + status =3D NVME_SC_INVALID_FIELD | NVME_SC_DNR; + goto out; + } + /* * Make sure we're passing at least a buffer of response header size. * If host provided data len is less than the header size, only the --=20 2.41.0 From nobody Fri Dec 19 14:21:15 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 54CEEC83F18 for ; Tue, 29 Aug 2023 09:14:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234452AbjH2JOR (ORCPT ); Tue, 29 Aug 2023 05:14:17 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51732 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234496AbjH2JNt (ORCPT ); Tue, 29 Aug 2023 05:13:49 -0400 Received: from smtp-out1.suse.de (smtp-out1.suse.de [IPv6:2001:67c:2178:6::1c]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 114F5194 for ; Tue, 29 Aug 2023 02:13:42 -0700 (PDT) Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by smtp-out1.suse.de (Postfix) with ESMTPS id 93E6B21869; Tue, 29 Aug 2023 09:13:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_rsa; t=1693300420; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=eB9aR/U6RXS2ICVTlyDomYJuoXmtN3u/uV5XxMcbYuo=; b=jqB6/4DD7H3h9Qv0f5H3Amcc7qkkeg0pN/kQ1MA7nKvvxByqMV0cLWoUrlmkVSdi75ajWw 6+DcvYqhXeG1vdz6Tp6I7eSBkCHQFAwGqfmmJ+yXo5FDmFgXSWciZD5Ke9d5Vl3qU7B7CJ Xc+4QY+uAm002euoxnqYy4MaNT8c/5A= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_ed25519; t=1693300420; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=eB9aR/U6RXS2ICVTlyDomYJuoXmtN3u/uV5XxMcbYuo=; b=gDO+TahvCneMmJqnz5bI64wB9N8vCLVS6ZJBqCCqOivnUJNoxhjZXOaxHWiR78fIVCEJJq rLaYC8qBh/KS5WDw== Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by imap2.suse-dmz.suse.de (Postfix) with ESMTPS id 8736013301; Tue, 29 Aug 2023 09:13:40 +0000 (UTC) Received: from dovecot-director2.suse.de ([192.168.254.65]) by imap2.suse-dmz.suse.de with ESMTPSA id IdP+IMS27WS2UwAAMHmgww (envelope-from ); Tue, 29 Aug 2023 09:13:40 +0000 From: Daniel Wagner To: linux-nvme@lists.infradead.org Cc: linux-kernel@vger.kernel.org, Hannes Reinecke , Sagi Grimberg , Jason Gunthorpe , James Smart , Chaitanya Kulkarni , Christoph Hellwig , Daniel Wagner Subject: [RFC v1 4/4] nvmet-discovery: do not use invalid port Date: Tue, 29 Aug 2023 11:13:49 +0200 Message-ID: <20230829091350.16156-5-dwagner@suse.de> X-Mailer: git-send-email 2.41.0 In-Reply-To: <20230829091350.16156-1-dwagner@suse.de> References: <20230829091350.16156-1-dwagner@suse.de> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" The port entry binding might not be existing and thus the req->port pointer is not valid. Reproducer: nvme/005 with active system nvmf-autoconnect systemd service. Signed-off-by: Daniel Wagner --- drivers/nvme/target/discovery.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/nvme/target/discovery.c b/drivers/nvme/target/discover= y.c index 668d257fa986..fc113057cb95 100644 --- a/drivers/nvme/target/discovery.c +++ b/drivers/nvme/target/discovery.c @@ -191,6 +191,15 @@ static void nvmet_execute_disc_get_log_page(struct nvm= et_req *req) goto out; } =20 + + /* No port assigned, portentrybinding is missing */ + if (!req->port) { + req->error_loc =3D + offsetof(struct nvme_get_log_page_command, lpo); + status =3D NVME_SC_INVALID_FIELD | NVME_SC_DNR; + goto out; + } + /* * Make sure we're passing at least a buffer of response header size. * If host provided data len is less than the header size, only the --=20 2.41.0