From nobody Mon Sep 28 20:09:11 2026 Received: from mail-pf1-f172.google.com (mail-pf1-f172.google.com [209.85.210.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3DB843D410E for ; Tue, 18 Aug 2026 03:52:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.172 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787025172; cv=none; b=lrWuFV4jc0xg+paLhnty1QKrtnst1pCkxtjR/7OLfSXa8cUnyxp/RbWzsFfmP8VdNKajhrUriLJB83es/UymwQ+mYvvr5jVCpajkjbInofMjK5+o90CqiO6kf/rAf5iHZvia5ODQmMi+lnbFJbMM4TxC7h126e3kbbcg2J1+rAc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787025172; c=relaxed/simple; bh=2rJfuZl7V4GaJNwGLLET/5XuukkWgGKRGeh00EpCrH8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ZHSutPAqe7EHDYrLXX5rX31A0VQQPT1jk0Cy/kXcH51sbtoPP4djbjwHksSP2Dc83MGrC9gNCehztmJEkkullwQa7rS16QFSdE20xTs7J0iu51wfapPNKNI358jxE8QjzYk7UxxJHVYfvdpXKgeO41y0SAEqFk32aWoD+qeTYQw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=isslab.korea.ac.kr; spf=none smtp.mailfrom=isslab.korea.ac.kr; dkim=pass (2048-bit key) header.d=isslab-korea-ac-kr.20251104.gappssmtp.com header.i=@isslab-korea-ac-kr.20251104.gappssmtp.com header.b=nhJ/LnD/; arc=none smtp.client-ip=209.85.210.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=isslab.korea.ac.kr Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=isslab.korea.ac.kr Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=isslab-korea-ac-kr.20251104.gappssmtp.com header.i=@isslab-korea-ac-kr.20251104.gappssmtp.com header.b="nhJ/LnD/" Received: by mail-pf1-f172.google.com with SMTP id d2e1a72fcca58-84faf87d19dso4427212b3a.3 for ; Mon, 17 Aug 2026 20:52:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=isslab-korea-ac-kr.20251104.gappssmtp.com; s=20251104; t=1787025168; x=1787629968; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=UV8ClkYyHBQt8qz8iO59yEdYsVyXo9a3l22jb6LF/yc=; b=nhJ/LnD/5QS5OMt0Rj9ztFscFLR2gsExhlf7TIdEv1wUrPrTUTZO0FKb26mRSFyptH GIhLS1GhWq7HaXp4RtdJ+QcjGzmQadK4KptBdfRK3eW/XiN5e4xXOiFqQ9MNhUKgr1nz jjo6A/R4toP22Uh+DMsURpGMXFX5ZDdM8ohiV18aeo0SPOTtwR35XCGT7Zc0fiM2+PJo 4xo4hVoa3wDvwVbCvqv79zSvArg3KHxQt5DfD84vVHIfZhqB5HhW+6jLzRnvi7Skji6A fnk30E3o4/CQqS+eDI74KEBBQfqj34R9vbsTbDnAeWtJObtEsk5sQ/QA1re/0lhgkmHS qOBA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787025168; x=1787629968; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=UV8ClkYyHBQt8qz8iO59yEdYsVyXo9a3l22jb6LF/yc=; b=U1NeDW8s5szdseIpN/OakEYHT2/y6hfIBu5VMOkeQiAYhQubKXP/SdvL4UgyBQ/eI4 ey9YAZPrG+nFBSkm7tA45Hls+jRQVApp21N9w4nsquasu+O4BKYIYAA3bZ9a1FzHRMAE PGocWZpcS/0aibWCyBmfZApeTLpLSSN6b9t7QyL/+sJ95tlR+eYr6EEGQtUi6RwDc3GD AFubtN76NC9g34tl6j0Fe9Sr0kahxV0s8CAP2j8afXhMHQefEH6wfdF/w9SkWLTX9Ef7 L0alGt9GB1l9CacRaLhnrSokx7IJ0nbT64s8zGkEhEtMHZdEUNeRlb2Nk3U0GE2bEfPm clcQ== X-Forwarded-Encrypted: i=1; AHgh+RoG8BEU375WFEInaP157zHaJhA5r6hJ59Vwueoin354IBjriRtDmjX8hLjPtIbuBRRO7P4oYRdQWEyZvlM=@vger.kernel.org X-Gm-Message-State: AOJu0YzU3oARBEMP44wrZ5pJmOnM3Bj/1FXiLzgcODy3Q6VjjxEk0Vad phbQSS73jeP7ambFPEhI1wCRN/gArBGOG47Unvcs1iBCtHAPDk71kMV4DqkIrH7CeEw= X-Gm-Gg: AR+sD12KCwdi3ZkC+j3X4v3YgkXkU2OMkzTc/hn6aLvfSEBgYAplT6dYzP/hQ+h8jl1 nsjDfll6Z7ZJ+7sMz5f892/40/5tOR1IEVlsijKg5H6QzHcGFaOj4bCdWdeTs3NVNMtYksN3+OL w8M4Tt8boQmgDqlYJuzyQsk9B1zJ2AvEZ0HBGPnN5ceaSrnUbfPV+FJkxHHfn8ygeUvR7TY1/sQ qnrNNs4QaeJi48BArACn/bV/tRK0f+Flb+YELnMkzYEAPVi6JHkJGKKkxQXgYM36+ufmtkbJkWm Of3tYm3M69Qt3sMauhksyGv+k//ibEseGomwHGsKgkMjuu6T1HUeGRD0cEX7Mjgg7orUTqWWDca ZvXm0mac4W6htR80WMPQglDaXnxjL8WnrN94OZl6L13YjFhzemhZiF6GyAj1HfTzjtKcG9FT1y6 1btaWsS2cARbLnYLq2yrNz9CXFfOOoc121QUw2zl2sqld6yySxerxf1991eYcI6l/agoMPCw== X-Received: by 2002:a05:6a00:10cd:b0:847:982e:cca0 with SMTP id d2e1a72fcca58-84fde1fd916mr28596104b3a.19.1787025168312; Mon, 17 Aug 2026 20:52:48 -0700 (PDT) Received: from yhlee-960QFG.. ([125.131.91.97]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-851b6f8bf71sm985058b3a.32.2026.08.17.20.52.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 17 Aug 2026 20:52:47 -0700 (PDT) From: Yehyeong Lee To: linux-rdma@vger.kernel.org Cc: bvanassche@acm.org, jgg@ziepe.ca, leon@kernel.org, linux-kernel@vger.kernel.org, Yehyeong Lee , stable@vger.kernel.org Subject: [PATCH v2 1/2] RDMA/srp: fix use-after-free of a request in srp_destroy_qp() Date: Tue, 18 Aug 2026 12:52:28 +0900 Message-ID: <20260818035229.505098-2-yhlee@isslab.korea.ac.kr> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260818035229.505098-1-yhlee@isslab.korea.ac.kr> References: <20260818035229.505098-1-yhlee@isslab.korea.ac.kr> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" srp_destroy_qp() drains the send queue before destroying the queue pair. For the fast registration and invalidation work requests the wr_cqe it finds there is &req->reg_cqe, which lives in the blk-mq request pool, and srp_remove_target() has already freed that pool through scsi_remove_host(): page_owner records the page freed by blk_mq_free_tags_callback() while that call is running. __ib_process_cq() then calls wc->wr_cqe->done on it. A target whose login fails after a command has been mapped leaves such a work request flushed in the send queue, and the drain reads it after the pool is gone. [ 18.969484] BUG: KASAN: use-after-free in __ib_process_cq+0x2ec/0x390 [ 18.970521] Read of size 8 at addr ffff888107cc5a50 by task kworker/0:= 1/11 [ 18.971544] [ 18.971811] CPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Not tainted 7.2.0-= rc5-CLEANA-gd788e9657d56-dirty #17 PREEMPT(lazy) [ 18.971819] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arc= h_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 18.971831] Workqueue: srp_remove srp_remove_work [ 18.971868] Call Trace: [ 18.971879] [ 18.971883] dump_stack_lvl+0x53/0x70 [ 18.971937] print_report+0xd0/0x630 [ 18.971987] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 18.972010] ? _raw_spin_lock_irqsave+0x85/0xe0 [ 18.972017] ? __ib_process_cq+0x2ec/0x390 [ 18.972022] kasan_report+0xce/0x100 [ 18.972027] ? __ib_process_cq+0x2ec/0x390 [ 18.972033] __ib_process_cq+0x2ec/0x390 [ 18.972038] ib_process_cq_direct+0x8e/0xd0 [ 18.972043] ? __pfx_ib_process_cq_direct+0x10/0x10 [ 18.972053] ? _raw_spin_lock_irq+0x80/0xe0 [ 18.972057] ? __pfx__raw_spin_lock_irq+0x10/0x10 [ 18.972061] ? kfree+0x121/0x380 [ 18.972083] srp_free_ch_ib+0x284/0xc00 [ 18.972090] srp_remove_work+0x30f/0x650 [ 18.972095] process_one_work+0x633/0x1030 [ 18.972127] ? assign_work+0x11d/0x370 [ 18.972132] worker_thread+0x45b/0xd10 [ 18.972138] ? __pfx_worker_thread+0x10/0x10 [ 18.972144] ? __pfx_worker_thread+0x10/0x10 [ 18.972149] kthread+0x2c6/0x3b0 [ 18.972163] ? recalc_sigpending+0x15c/0x1e0 [ 18.972184] ? __pfx_kthread+0x10/0x10 [ 18.972188] ret_from_fork+0x36e/0x5a0 [ 18.972212] ? __pfx_ret_from_fork+0x10/0x10 [ 18.972217] ? __switch_to+0x572/0xdd0 [ 18.972231] ? __pfx_kthread+0x10/0x10 [ 18.972236] ret_from_fork_asm+0x1a/0x30 [ 18.972247] [ 18.972250] [ 18.993356] The buggy address belongs to the physical page: [ 18.994084] page: refcount:0 mapcount:0 mapping:0000000000000000 index= :0x0 pfn:0x107cc5 [ 18.995090] flags: 0x200000000000000(node=3D0|zone=3D2) [ 18.995739] raw: 0200000000000000 ffffea00041f3148 ffffea00041f3148 00= 00000000000000 [ 18.996725] raw: 0000000000000000 0000000000000000 00000000ffffffff 00= 00000000000000 [ 18.997705] page dumped because: kasan: bad access detected [ 18.998427] [ 18.998644] Memory state around the buggy address: [ 18.999235] ffff888107cc5900: ff ff ff ff ff ff ff ff ff ff ff ff ff = ff ff ff [ 19.000867] ffff888107cc5980: ff ff ff ff ff ff ff ff ff ff ff ff ff = ff ff ff [ 19.002577] >ffff888107cc5a00: ff ff ff ff ff ff ff ff ff ff ff ff ff = ff ff ff [ 19.003500] ^ [ 19.004261] ffff888107cc5a80: ff ff ff ff ff ff ff ff ff ff ff ff ff = ff ff ff [ 19.005198] ffff888107cc5b00: ff ff ff ff ff ff ff ff ff ff ff ff ff = ff ff ff The completion does not identify the request. Both handlers hand it to srp_handle_qp_err(), which finds the channel through cq->cq_context, and neither work request is signalled on success. Put the two completion contexts in the channel, which outlives the queue pair. Fixes: 9294000d6d89 ("IB/srp: Drain the send queue before destroying a QP") Cc: stable@vger.kernel.org Signed-off-by: Yehyeong Lee --- drivers/infiniband/ulp/srp/ib_srp.c | 16 ++++++++-------- drivers/infiniband/ulp/srp/ib_srp.h | 8 +++++++- 2 files changed, 15 insertions(+), 9 deletions(-) diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/s= rp/ib_srp.c index 6b429ef63f8f3..f3f19277c2720 100644 --- a/drivers/infiniband/ulp/srp/ib_srp.c +++ b/drivers/infiniband/ulp/srp/ib_srp.c @@ -144,6 +144,8 @@ static void srp_rename_dev(struct ib_device *device, vo= id *client_data); static void srp_recv_done(struct ib_cq *cq, struct ib_wc *wc); static void srp_handle_qp_err(struct ib_cq *cq, struct ib_wc *wc, const char *opname); +static void srp_inv_rkey_err_done(struct ib_cq *cq, struct ib_wc *wc); +static void srp_reg_mr_err_done(struct ib_cq *cq, struct ib_wc *wc); static int srp_ib_cm_handler(struct ib_cm_id *cm_id, const struct ib_cm_event *event); static int srp_rdma_cm_handler(struct rdma_cm_id *cm_id, @@ -604,6 +606,8 @@ static int srp_create_ch_ib(struct srp_rdma_ch *ch) ch->qp =3D qp; ch->recv_cq =3D recv_cq; ch->send_cq =3D send_cq; + ch->reg_cqe.done =3D srp_reg_mr_err_done; + ch->inv_cqe.done =3D srp_inv_rkey_err_done; =20 if (dev->use_fast_reg) { if (ch->fr_pool) @@ -1159,8 +1163,7 @@ static void srp_inv_rkey_err_done(struct ib_cq *cq, s= truct ib_wc *wc) srp_handle_qp_err(cq, wc, "INV RKEY"); } =20 -static int srp_inv_rkey(struct srp_request *req, struct srp_rdma_ch *ch, - u32 rkey) +static int srp_inv_rkey(struct srp_rdma_ch *ch, u32 rkey) { struct ib_send_wr wr =3D { .opcode =3D IB_WR_LOCAL_INV, @@ -1170,8 +1173,7 @@ static int srp_inv_rkey(struct srp_request *req, stru= ct srp_rdma_ch *ch, .ex.invalidate_rkey =3D rkey, }; =20 - wr.wr_cqe =3D &req->reg_cqe; - req->reg_cqe.done =3D srp_inv_rkey_err_done; + wr.wr_cqe =3D &ch->inv_cqe; return ib_post_send(ch->qp, &wr, NULL); } =20 @@ -1193,7 +1195,7 @@ static void srp_unmap_data(struct scsi_cmnd *scmnd, struct srp_fr_desc **pfr; =20 for (i =3D req->nmdesc, pfr =3D req->fr_list; i > 0; i--, pfr++) { - res =3D srp_inv_rkey(req, ch, (*pfr)->mr->rkey); + res =3D srp_inv_rkey(ch, (*pfr)->mr->rkey); if (res < 0) { shost_printk(KERN_ERR, target->scsi_host, PFX "Queueing INV WR for rkey %#x failed (%d)\n", @@ -1470,11 +1472,9 @@ static int srp_map_finish_fr(struct srp_map_state *s= tate, =20 WARN_ON_ONCE(desc->mr->length =3D=3D 0); =20 - req->reg_cqe.done =3D srp_reg_mr_err_done; - wr.wr.next =3D NULL; wr.wr.opcode =3D IB_WR_REG_MR; - wr.wr.wr_cqe =3D &req->reg_cqe; + wr.wr.wr_cqe =3D &ch->reg_cqe; wr.wr.num_sge =3D 0; wr.wr.send_flags =3D 0; wr.mr =3D desc->mr; diff --git a/drivers/infiniband/ulp/srp/ib_srp.h b/drivers/infiniband/ulp/s= rp/ib_srp.h index 349576ff38450..22720f103d4eb 100644 --- a/drivers/infiniband/ulp/srp/ib_srp.h +++ b/drivers/infiniband/ulp/srp/ib_srp.h @@ -137,7 +137,6 @@ struct srp_request { struct srp_direct_buf *indirect_desc; dma_addr_t indirect_dma_addr; short nmdesc; - struct ib_cqe reg_cqe; }; =20 /** @@ -145,6 +144,10 @@ struct srp_request { * @comp_vector: Completion vector used by this RDMA channel. * @max_it_iu_len: Maximum initiator-to-target information unit length. * @max_ti_iu_len: Maximum target-to-initiator information unit length. + * @reg_cqe: Completion context for fast registration work requests. + * @inv_cqe: Completion context for invalidation work requests. These are + * per channel because their completions do not identify the request and + * because the request pool can be freed before the send queue is drained. */ struct srp_rdma_ch { /* These are RW in the hot path, and commonly used together */ @@ -170,6 +173,9 @@ struct srp_rdma_ch { struct completion done; int status; =20 + struct ib_cqe reg_cqe; + struct ib_cqe inv_cqe; + union { struct ib_cm { struct sa_path_rec path; --=20 2.43.0 From nobody Mon Sep 28 20:09:11 2026 Received: from mail-pf1-f169.google.com (mail-pf1-f169.google.com [209.85.210.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4B6D33D5679 for ; Tue, 18 Aug 2026 03:52:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.169 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787025172; cv=none; b=JjXkdYXVsRib31kmKWxq6+QWJ6GS6/cxgzcs87vb5fFx0Ov19tALiCcIdA6pZceGeqEBeAc/B/MvZN/33Xa5Qc4q9IcYHW+wo764IbY+p7evm8h3MtnFp6OQycFQ2NL5gaFexor5s0uOgreiH9Ji2/7Rl6UW2w/XeKIsHIp8XPI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787025172; c=relaxed/simple; bh=Pp6cXGbI+zztA+jMneI7X7NUe8//2gZ37q5m42nPhF4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Lyl6O5RoEtfmpAYpPNkftH75cTEB7uPKtTc8yRDNFqJJNl+aelRT6s884YZJM+JG+68KkYdgqpwT4Y+2QJoyblZZqP/IhGoubsfqi6tMVz4w5Dnf6URaHDqIISaQHgMc+FwrdZkF5WitFdViXtNC6do5ksPTtWRMez4IoZiGYkE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=isslab.korea.ac.kr; spf=none smtp.mailfrom=isslab.korea.ac.kr; dkim=pass (2048-bit key) header.d=isslab-korea-ac-kr.20251104.gappssmtp.com header.i=@isslab-korea-ac-kr.20251104.gappssmtp.com header.b=Mar1dps1; arc=none smtp.client-ip=209.85.210.169 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=isslab.korea.ac.kr Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=isslab.korea.ac.kr Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=isslab-korea-ac-kr.20251104.gappssmtp.com header.i=@isslab-korea-ac-kr.20251104.gappssmtp.com header.b="Mar1dps1" Received: by mail-pf1-f169.google.com with SMTP id d2e1a72fcca58-84fa3b14ee1so3045478b3a.0 for ; Mon, 17 Aug 2026 20:52:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=isslab-korea-ac-kr.20251104.gappssmtp.com; s=20251104; t=1787025171; x=1787629971; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=4FujdklHHhC6Wo8/B2DN1Z5wq1yNgGtjdADnNC3zDrc=; b=Mar1dps1bChFBy/4oaNA8tb3aD9V+mYAWy0CeZQoitsWSoVkZozfSNOp1v8jzMN/kU o8iae7nMgDIYgug36b/e8qTCJyMQo/abgEsaOPC0+AKfq0ONFzRocGlqVPSS1UlCMOjh KjdQbhdFJ38VJAa1AINzjVoLa8w654Mb2L0GjGRG5rBkewZwYZAoW+f2ziy+170IWvj+ ZoKnr4pgmA2dvdIHGqS2RikwEmZoN/PrIVzbKK1q0iVddWS89gfaraJEPQM4g35LmNJq m6874i/6QI/K2H6oxYfhhUnqvE+sOJLsXP/8vXz+/ZosNNpYWEHRp0uOTXSoDvjrwqux HNtg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787025171; x=1787629971; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=4FujdklHHhC6Wo8/B2DN1Z5wq1yNgGtjdADnNC3zDrc=; b=R0oOo/p/aZKqDUwla/Kop3771KfsB5mI7kV25V27t87nGOVql5MAsQWYptz9fb40ih 6WMGl5bXUKZAoWv3CsKsEiw51WEvp24Cfa9/g+mHI695svmoSw93793UtuXIU/QAcSQ+ YmwFFmUz9rNQLPrt83ppUCsstUXMeQyZa8NfzGN0NZTEooITzr8bxOmj8wtDVoFleB9F Yw/rawBMj87dx+UaRktal9lw/uYXmvnUHBFtMrVe+W0XASeazSBw/rR07+41Zou9UMAy 4c15SSRIX6y8VigmK6CryTJMU9MyZ9z/9lLeaG5u1GxRnUi1tWK9WqLfFZZOXRCNL0dA SZHA== X-Forwarded-Encrypted: i=1; AHgh+RoX2Y9W+Ca7EqvZZFxS6xdCOcKD+fUt3PgfobRJxs2xOuvhKfOJoWWkj+I8jePXcNvMgIe1EhH8RdcuI+0=@vger.kernel.org X-Gm-Message-State: AOJu0YzISF0LoJjpCiz70pwKlHcSxOYaaymhEZ9H7lHzeBSFYoQJGCuW j+mease0xRdQ7nzmwoqyQbA2oYOQzL4jZsvuZizSJVRO4OhU4oJnZn5qK+UD4k/V9KM= X-Gm-Gg: AR+sD11OESPCxJbWwXuHKoypdAkX1mQjHB1wF999L0EHzU97LyqXN4gKoYkjPJupKGL sy53Vo22GqZTFgiaPYkOxSjFxeNGDCMtJg38EuwcbQrYrb01hZH3yfBNCOB1bI6UQrROfDbH00x hJ0Wcit7HutiGDDtX1vNKUmMu4LS6Nck3KUA3ekw75EX4+SqgkemFiWy6zf0PY9KB3trXN2alwQ QXa6k0b4KP1i55PX0JgYUUbkbeVZhJgedfBEqiRJx25aSOrIWy1psWfu5yhYEpCztxSdXFV0uhN 6BptJafieq/Uu/ihEZmQqjVVxe7n6Wos1GjkLmQaGDU1YXSDalh0xXw78R4UrCNb310i7lAp3cM 3dFmXpKZnyLcRCxnlwEXKxOT198DOzbiAjaT4QoFasb9y1RwbDipvjGkkOOCoM6QL2q254e3D/2 /XGoiCnlrjWWu7/c7W/DbfQqBNqKOZ88DAfY36nCkUUMwyxPT0dIvsZbdkPhsinOQWO40urlp/Q EefJvY= X-Received: by 2002:a05:6a00:14c8:b0:848:6c9c:4074 with SMTP id d2e1a72fcca58-851b87eaab3mr6002203b3a.1.1787025170684; Mon, 17 Aug 2026 20:52:50 -0700 (PDT) Received: from yhlee-960QFG.. ([125.131.91.97]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-851b6f8bf71sm985058b3a.32.2026.08.17.20.52.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 17 Aug 2026 20:52:50 -0700 (PDT) From: Yehyeong Lee To: linux-rdma@vger.kernel.org Cc: bvanassche@acm.org, jgg@ziepe.ca, leon@kernel.org, linux-kernel@vger.kernel.org, Yehyeong Lee Subject: [PATCH v2 2/2] RDMA/srp: Fix srp_remove_target() Date: Tue, 18 Aug 2026 12:52:29 +0900 Message-ID: <20260818035229.505098-3-yhlee@isslab.korea.ac.kr> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260818035229.505098-1-yhlee@isslab.korea.ac.kr> References: <20260818035229.505098-1-yhlee@isslab.korea.ac.kr> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Bart Van Assche Remove all logical units before disconnecting the transport because one or more SCSI commands may be submitted while removing logical units. Remove the SCSI host after the transport has been disconnected because the code that disconnects the transport needs resources that are freed by the code that removes the SCSI host (SCSI host tag set). Remove the srp_rport_get() and srp_rport_put() calls because the purpose of these calls was to keep the rport until tl_err_work is cancelled. Reported-by: Yehyeong Lee Closes: https://lore.kernel.org/linux-rdma/20260812190418.200337-1-yhlee@is= slab.korea.ac.kr/ Signed-off-by: Bart Van Assche Signed-off-by: Yehyeong Lee --- drivers/infiniband/ulp/srp/ib_srp.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/s= rp/ib_srp.c index f3f19277c2720..ee2bd209b5cde 100644 --- a/drivers/infiniband/ulp/srp/ib_srp.c +++ b/drivers/infiniband/ulp/srp/ib_srp.c @@ -1042,15 +1042,20 @@ static void srp_del_scsi_host_attr(struct Scsi_Host= *shost) =20 static void srp_remove_target(struct srp_target_port *target) { + struct scsi_device *sdev; struct srp_rdma_ch *ch; int i; =20 WARN_ON_ONCE(target->state !=3D SRP_TARGET_REMOVED); =20 srp_del_scsi_host_attr(target->scsi_host); - srp_rport_get(target->rport); - srp_remove_host(target->scsi_host); - scsi_remove_host(target->scsi_host); + /* + * Remove all logical units. This must happen before the + * srp_disconnect_target() call because scsi_remove_device() may trigger + * submission of SCSI commands. See also sd_shutdown(). + */ + shost_for_each_device(sdev, target->scsi_host) + scsi_remove_device(sdev); srp_stop_rport_timers(target->rport); srp_disconnect_target(target); kobj_ns_drop(KOBJ_NS_TYPE_NET, to_ns_common(target->net)); @@ -1059,7 +1064,8 @@ static void srp_remove_target(struct srp_target_port = *target) srp_free_ch_ib(target, ch); } cancel_work_sync(&target->tl_err_work); - srp_rport_put(target->rport); + srp_remove_host(target->scsi_host); + scsi_remove_host(target->scsi_host); kfree(target->ch); target->ch =3D NULL; =20 --=20 2.43.0