Commit 0fbcfb08 authored by Sagi Grimberg's avatar Sagi Grimberg Committed by Christoph Hellwig
Browse files

nvmet-tcp: fix potential race of tcp socket closing accept_work 



When we accept a TCP connection and allocate an nvmet-tcp queue we should
make sure not to fully establish it or reference it as the connection may
be already closing, which triggers queue release work, which does not
fence against queue establishment.

In order to address such a race, we make sure to check the sk_state and
contain the queue reference to be done underneath the sk_callback_lock
such that the queue release work correctly fences against it.

Fixes: 872d26a3 ("nvmet-tcp: add NVMe over TCP target driver")
Reported-by: default avatarElad Grupi <elad.grupi@dell.com>
Signed-off-by: default avatarSagi Grimberg <sagi@grimberg.me>
Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
parent fda871c0

drivers/nvme/target/tcp.c

+18 −10
Original line number Diff line number Diff line
@@ -1484,7 +1484,15 @@ static int nvmet_tcp_set_queue_sock(struct nvmet_tcp_queue *queue) 
	if (inet->rcv_tos > 0)

		ip_sock_set_tos(sock->sk, inet->rcv_tos);



	ret = 0;

	write_lock_bh(&sock->sk->sk_callback_lock);

	if (sock->sk->sk_state != TCP_ESTABLISHED) {

		/*

		 * If the socket is already closing, don't even start

		 * consuming it

		 */

		ret = -ENOTCONN;

	} else {

		sock->sk->sk_user_data = queue;

		queue->data_ready = sock->sk->sk_data_ready;

		sock->sk->sk_data_ready = nvmet_tcp_data_ready;
@@ -1492,9 +1500,11 @@ static int nvmet_tcp_set_queue_sock(struct nvmet_tcp_queue *queue) 
		sock->sk->sk_state_change = nvmet_tcp_state_change;

		queue->write_space = sock->sk->sk_write_space;

		sock->sk->sk_write_space = nvmet_tcp_write_space;

		queue_work_on(queue_cpu(queue), nvmet_tcp_wq, &queue->io_work);

	}

	write_unlock_bh(&sock->sk->sk_callback_lock);



	return 0;

	return ret;

}



static int nvmet_tcp_alloc_queue(struct nvmet_tcp_port *port,
@@ -1542,8 +1552,6 @@ static int nvmet_tcp_alloc_queue(struct nvmet_tcp_port *port, 
	if (ret)

		goto out_destroy_sq;



	queue_work_on(queue_cpu(queue), nvmet_tcp_wq, &queue->io_work);



	return 0;

out_destroy_sq:

	mutex_lock(&nvmet_tcp_queue_mutex);