Commit 9edceaf4 authored by Daniel Wagner's avatar Daniel Wagner Committed by Christoph Hellwig
Browse files

nvme: avoid race in shutdown namespace removal 



When we remove the siblings entry, we update ns->head->list, hence we
can't separate the removal and test for being empty. They have to be
in the same critical section to avoid a race.

To avoid breaking the refcounting imbalance again, add a list empty
check to nvme_find_ns_head.

Fixes: 5396fdac ("nvme: fix refcounting imbalance when all paths are down")
Signed-off-by: default avatarDaniel Wagner <dwagner@suse.de>
Reviewed-by: default avatarHannes Reinecke <hare@suse.de>
Tested-by: default avatarHannes Reinecke <hare@suse.de>
Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
parent 0bd46e22

drivers/nvme/host/core.c

+7 −8
Original line number Diff line number Diff line
@@ -3524,7 +3524,9 @@ static struct nvme_ns_head *nvme_find_ns_head(struct nvme_subsystem *subsys, 
	lockdep_assert_held(&subsys->lock);



	list_for_each_entry(h, &subsys->nsheads, entry) {

		if (h->ns_id == nsid && nvme_tryget_ns_head(h))

		if (h->ns_id != nsid)

			continue;

		if (!list_empty(&h->list) && nvme_tryget_ns_head(h))

			return h;

	}
@@ -3843,6 +3845,10 @@ static void nvme_ns_remove(struct nvme_ns *ns) 


	mutex_lock(&ns->ctrl->subsys->lock);

	list_del_rcu(&ns->siblings);

	if (list_empty(&ns->head->list)) {

		list_del_init(&ns->head->entry);

		last_path = true;

	}

	mutex_unlock(&ns->ctrl->subsys->lock);



	/* guarantee not available in head->list */
@@ -3863,13 +3869,6 @@ static void nvme_ns_remove(struct nvme_ns *ns) 
	list_del_init(&ns->list);

	up_write(&ns->ctrl->namespaces_rwsem);



	/* Synchronize with nvme_init_ns_head() */

	mutex_lock(&ns->head->subsys->lock);

	if (list_empty(&ns->head->list)) {

		list_del_init(&ns->head->entry);

		last_path = true;

	}

	mutex_unlock(&ns->head->subsys->lock);

	if (last_path)

		nvme_mpath_shutdown_disk(ns->head);

	nvme_put_ns(ns);