Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6f8e0d78 authored by Jianchao Wang's avatar Jianchao Wang Committed by Jens Axboe
Browse files

nvme: fix the dangerous reference of namespaces list 



nvme_remove_namespaces and nvme_remove_invalid_namespaces reference
the ctrl->namespaces list w/o holding namespaces_mutext. It is ok
to invoke nvme_ns_remove there, but what if there is others.

To be safer, reference the ctrl->namespaces list under
namespaces_mutext.

Reviewed-by: default avatarKeith Busch <keith.busch@intel.com>
Signed-off-by: default avatarJianchao Wang <jianchao.w.wang@oracle.com>
Signed-off-by: default avatarSagi Grimberg <sagi@grimberg.me>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 9a915a5b

drivers/nvme/host/core.c

+14 −2
Original line number Diff line number Diff line
@@ -3098,11 +3098,18 @@ static void nvme_remove_invalid_namespaces(struct nvme_ctrl *ctrl, 
					unsigned nsid)

{

	struct nvme_ns *ns, *next;

	LIST_HEAD(rm_list);



	mutex_lock(&ctrl->namespaces_mutex);

	list_for_each_entry_safe(ns, next, &ctrl->namespaces, list) {

		if (ns->head->ns_id > nsid)

			nvme_ns_remove(ns);

			list_move_tail(&ns->list, &rm_list);

	}

	mutex_unlock(&ctrl->namespaces_mutex);



	list_for_each_entry_safe(ns, next, &rm_list, list)

		nvme_ns_remove(ns);



}



static int nvme_scan_ns_list(struct nvme_ctrl *ctrl, unsigned nn)
@@ -3202,6 +3209,7 @@ EXPORT_SYMBOL_GPL(nvme_queue_scan); 
void nvme_remove_namespaces(struct nvme_ctrl *ctrl)

{

	struct nvme_ns *ns, *next;

	LIST_HEAD(ns_list);



	/*

	 * The dead states indicates the controller was not gracefully
@@ -3212,7 +3220,11 @@ void nvme_remove_namespaces(struct nvme_ctrl *ctrl) 
	if (ctrl->state == NVME_CTRL_DEAD)

		nvme_kill_queues(ctrl);



	list_for_each_entry_safe(ns, next, &ctrl->namespaces, list)

	mutex_lock(&ctrl->namespaces_mutex);

	list_splice_init(&ctrl->namespaces, &ns_list);

	mutex_unlock(&ctrl->namespaces_mutex);



	list_for_each_entry_safe(ns, next, &ns_list, list)

		nvme_ns_remove(ns);

}

EXPORT_SYMBOL_GPL(nvme_remove_namespaces);