nvme_fcloop: fix abort race condition
authorJames Smart <jsmart2021@gmail.com>
Thu, 30 Nov 2017 00:47:30 +0000 (16:47 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 12 Apr 2018 10:32:16 +0000 (12:32 +0200)
commitf0504bf54b4dd068e6a8c4c3b3de4a50a4f7da79
tree7db84f66666e935febb1f9f9027bce2fdb99f415
parent39ede1fd200f0f43bc87e12bf6cced45de610232
nvme_fcloop: fix abort race condition

[ Upstream commit 278e096063f1914fccfc77a617be9fc8dbb31b0e ]

A test case revealed a race condition of an i/o completing on a thread
parallel to the delete_association generating the aborts for the
outstanding ios on the controller.  The i/o completion was freeing the
target fcloop context, thus the abort task referenced the just-freed
memory.

Correct by clearing the target/initiator cross pointers in the io
completion and abort tasks before calling the callbacks. On aborts
that detect already finished io's, ensure the complete context is
called.

Signed-off-by: James Smart <james.smart@broadcom.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/nvme/target/fcloop.c