diff options
| author |   Israel Rukshin <israelr@mellanox.com> | 2017-11-05 08:43:01 +0000 |
|---|---|---|
| committer |   Jens Axboe <axboe@kernel.dk> | 2017-11-10 19:53:25 -0700 |
| commit | 43b92fd27aaef0f529c9321cfebbaec1d7b8f503 (patch) | |
| tree | 8709595d742fd21f2f0afa4e77b1610e1a3d62a1 /drivers/nvme | |
| parent | lpfc: tie in to new dev_loss_tmo interface in nvme transport (diff) | |
| download | linux-dev-43b92fd27aaef0f529c9321cfebbaec1d7b8f503.tar.xz linux-dev-43b92fd27aaef0f529c9321cfebbaec1d7b8f503.zip | |
nvmet-rdma: update queue list during ib_device removal
A NULL deref happens when nvmet_rdma_remove_one() is called more than once
(e.g. while connected via 2 ports).
The first call frees the queues related to the first ib_device but
doesn't remove them from the queue list.
While calling nvmet_rdma_remove_one() for the second ib_device it goes over
the full queue list again and we get the NULL deref.
Fixes: f1d4ef7d ("nvmet-rdma: register ib_client to not deadlock in device removal")
Signed-off-by: Israel Rukshin <israelr@mellanox.com>
Reviewed-by: Max Gurtovoy <maxg@mellanox.com>
Reviewed-by: Sagi Grimberg <sagi@grmberg.me>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'drivers/nvme')
| -rw-r--r-- | drivers/nvme/target/rdma.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c index 76d2bb793afe..3333d417b248 100644 --- a/drivers/nvme/target/rdma.c +++ b/drivers/nvme/target/rdma.c @@ -1512,15 +1512,17 @@ static struct nvmet_fabrics_ops nvmet_rdma_ops = { static void nvmet_rdma_remove_one(struct ib_device *ib_device, void *client_data) { - struct nvmet_rdma_queue *queue; + struct nvmet_rdma_queue *queue, *tmp; /* Device is being removed, delete all queues using this device */ mutex_lock(&nvmet_rdma_queue_mutex); - list_for_each_entry(queue, &nvmet_rdma_queue_list, queue_list) { + list_for_each_entry_safe(queue, tmp, &nvmet_rdma_queue_list, + queue_list) { if (queue->dev->device != ib_device) continue; pr_info("Removing queue %d\n", queue->idx); + list_del_init(&queue->queue_list); __nvmet_rdma_queue_disconnect(queue); } mutex_unlock(&nvmet_rdma_queue_mutex); |