Skip to content
Snippets Groups Projects
Commit 45d27460 authored by Chao Leng's avatar Chao Leng Committed by Yang Yingliang
Browse files

nvme-rdma: avoid request double completion for concurrent nvme_rdma_timeout

mainline inclusion
from mainline-v5.11-rc5
commit 7674073b2ed35ac951a49c425dec6b39d5a57140
category: bugfix
bugzilla: NA
CVE: NA
Link: https://gitee.com/openeuler/kernel/issues/I1WGZE



-------------------------------------------------

A crash happens when inject completing request long time(nearly 30s).
Each name space has a request queue, when inject completing request long
time, multi request queues may have time out requests at the same time,
nvme_rdma_timeout will execute concurrently. Multi requests in different
request queues may be queued in the same rdma queue, multi
nvme_rdma_timeout may call nvme_rdma_stop_queue at the same time.
The first nvme_rdma_timeout will clear NVME_RDMA_Q_LIVE and continue
stopping the rdma queue(drain qp), but the others check NVME_RDMA_Q_LIVE
is already cleared, and then directly complete the requests, complete
request before the qp is fully drained may lead to a use-after-free
condition.

Add a multex lock to serialize nvme_rdma_stop_queue.

Signed-off-by: default avatarChao Leng <lengchao@huawei.com>
Tested-by: default avatarIsrael Rukshin <israelr@nvidia.com>
Reviewed-by: default avatarIsrael Rukshin <israelr@nvidia.com>
Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>

conflicts:
drivers/nvme/host/rdma.c
[lrz: adjust context]

Signed-off-by: default avatarRuozhu Li <liruozhu@huawei.com>
Reviewed-by: default avatarHou Tao <houtao1@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parent cbadcad3
No related branches found
No related tags found
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment