Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit baa6719f authored by Hannes Reinecke's avatar Hannes Reinecke Committed by Martin K. Petersen
Browse files

libfc: Update rport reference counting 



Originally libfc would just be initializing the refcount to '1', and
using the disc_mutex to synchronize if and when the final put should be
happening.  This has a race condition as the mutex might be delayed,
causing other threads to access an invalid structure.  This patch
updates the rport reference counting to increase the reference every
time 'rport_lookup' is called, and decreases the reference
correspondingly.  This removes the need to hold 'disc_mutex' when
removing the structure, and avoids the above race condition.

Signed-off-by: default avatarHannes Reinecke <hare@suse.com>
Acked-by: default avatarVasu Dev <vasu.dev@intel.com>
Reviewed-by: default avatarJohannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent 7e1ee441

drivers/scsi/fcoe/fcoe_ctlr.c

+1 −6
Original line number Diff line number Diff line
@@ -2496,14 +2496,13 @@ static int fcoe_ctlr_vn_lookup(struct fcoe_ctlr *fip, u32 port_id, u8 *mac) 
	struct fcoe_rport *frport;

	int ret = -1;



	rcu_read_lock();

	rdata = lport->tt.rport_lookup(lport, port_id);

	if (rdata) {

		frport = fcoe_ctlr_rport(rdata);

		memcpy(mac, frport->enode_mac, ETH_ALEN);

		ret = 0;

		kref_put(&rdata->kref, lport->tt.rport_destroy);

	}

	rcu_read_unlock();

	return ret;

}
@@ -2585,11 +2584,7 @@ static void fcoe_ctlr_vn_beacon(struct fcoe_ctlr *fip, 
		fcoe_ctlr_vn_send(fip, FIP_SC_VN_PROBE_REQ, fcoe_all_vn2vn, 0);

		return;

	}

	mutex_lock(&lport->disc.disc_mutex);

	rdata = lport->tt.rport_lookup(lport, new->ids.port_id);

	if (rdata)

		kref_get(&rdata->kref);

	mutex_unlock(&lport->disc.disc_mutex);

	if (rdata) {

		if (rdata->ids.node_name == new->ids.node_name &&

		    rdata->ids.port_name == new->ids.port_name) {

drivers/scsi/libfc/fc_lport.c

+12 −7
Original line number Diff line number Diff line
@@ -2090,7 +2090,7 @@ int fc_lport_bsg_request(struct fc_bsg_job *job) 
	struct fc_rport *rport;

	struct fc_rport_priv *rdata;

	int rc = -EINVAL;

	u32 did;

	u32 did, tov;



	job->reply->reply_payload_rcv_len = 0;

	if (rsp)
@@ -2121,15 +2121,20 @@ int fc_lport_bsg_request(struct fc_bsg_job *job) 


	case FC_BSG_HST_CT:

		did = ntoh24(job->request->rqst_data.h_ct.port_id);

		if (did == FC_FID_DIR_SERV)

		if (did == FC_FID_DIR_SERV) {

			rdata = lport->dns_rdata;

		else

			if (!rdata)

				break;

			tov = rdata->e_d_tov;

		} else {

			rdata = lport->tt.rport_lookup(lport, did);



			if (!rdata)

				break;

			tov = rdata->e_d_tov;

			kref_put(&rdata->kref, lport->tt.rport_destroy);

		}



		rc = fc_lport_ct_request(job, lport, did, rdata->e_d_tov);

		rc = fc_lport_ct_request(job, lport, did, tov);

		break;



	case FC_BSG_HST_ELS_NOLOGIN:

drivers/scsi/libfc/fc_rport.c

+25 −24
Original line number Diff line number Diff line
@@ -95,17 +95,23 @@ static const char *fc_rport_state_names[] = { 
 * @lport:   The local port to lookup the remote port on

 * @port_id: The remote port ID to look up

 *

 * The caller must hold either disc_mutex or rcu_read_lock().

 * The reference count of the fc_rport_priv structure is

 * increased by one.

 */

static struct fc_rport_priv *fc_rport_lookup(const struct fc_lport *lport,

					     u32 port_id)

{

	struct fc_rport_priv *rdata;

	struct fc_rport_priv *rdata = NULL, *tmp_rdata;



	list_for_each_entry_rcu(rdata, &lport->disc.rports, peers)

		if (rdata->ids.port_id == port_id)

	rcu_read_lock();

	list_for_each_entry_rcu(tmp_rdata, &lport->disc.rports, peers)

		if (tmp_rdata->ids.port_id == port_id &&

		    kref_get_unless_zero(&tmp_rdata->kref)) {

			rdata = tmp_rdata;

			break;

		}

	rcu_read_unlock();

	return rdata;

	return NULL;

}



/**
@@ -340,7 +346,6 @@ static void fc_rport_work(struct work_struct *work) 
			fc_remote_port_delete(rport);

		}



		mutex_lock(&lport->disc.disc_mutex);

		mutex_lock(&rdata->rp_mutex);

		if (rdata->rp_state == RPORT_ST_DELETE) {

			if (port_id == FC_FID_DIR_SERV) {
@@ -370,7 +375,6 @@ static void fc_rport_work(struct work_struct *work) 
				fc_rport_enter_ready(rdata);

			mutex_unlock(&rdata->rp_mutex);

		}

		mutex_unlock(&lport->disc.disc_mutex);

		break;



	default:
@@ -702,7 +706,7 @@ static void fc_rport_flogi_resp(struct fc_seq *sp, struct fc_frame *fp, 
err:

	mutex_unlock(&rdata->rp_mutex);

put:

	kref_put(&rdata->kref, rdata->local_port->tt.rport_destroy);

	kref_put(&rdata->kref, lport->tt.rport_destroy);

	return;

bad:

	FC_RPORT_DBG(rdata, "Bad FLOGI response\n");
@@ -762,8 +766,6 @@ static void fc_rport_recv_flogi_req(struct fc_lport *lport, 
	FC_RPORT_ID_DBG(lport, sid, "Received FLOGI request\n");



	disc = &lport->disc;

	mutex_lock(&disc->disc_mutex);



	if (!lport->point_to_multipoint) {

		rjt_data.reason = ELS_RJT_UNSUP;

		rjt_data.explan = ELS_EXPL_NONE;
@@ -808,7 +810,7 @@ static void fc_rport_recv_flogi_req(struct fc_lport *lport, 
		mutex_unlock(&rdata->rp_mutex);

		rjt_data.reason = ELS_RJT_FIP;

		rjt_data.explan = ELS_EXPL_NOT_NEIGHBOR;

		goto reject;

		goto reject_put;

	case RPORT_ST_FLOGI:

	case RPORT_ST_PLOGI_WAIT:

	case RPORT_ST_PLOGI:
@@ -825,13 +827,13 @@ static void fc_rport_recv_flogi_req(struct fc_lport *lport, 
		mutex_unlock(&rdata->rp_mutex);

		rjt_data.reason = ELS_RJT_BUSY;

		rjt_data.explan = ELS_EXPL_NONE;

		goto reject;

		goto reject_put;

	}

	if (fc_rport_login_complete(rdata, fp)) {

		mutex_unlock(&rdata->rp_mutex);

		rjt_data.reason = ELS_RJT_LOGIC;

		rjt_data.explan = ELS_EXPL_NONE;

		goto reject;

		goto reject_put;

	}



	fp = fc_frame_alloc(lport, sizeof(*flp));
@@ -851,12 +853,13 @@ static void fc_rport_recv_flogi_req(struct fc_lport *lport, 
		fc_rport_state_enter(rdata, RPORT_ST_PLOGI_WAIT);

out:

	mutex_unlock(&rdata->rp_mutex);

	mutex_unlock(&disc->disc_mutex);

	kref_put(&rdata->kref, lport->tt.rport_destroy);

	fc_frame_free(rx_fp);

	return;



reject_put:

	kref_put(&rdata->kref, lport->tt.rport_destroy);

reject:

	mutex_unlock(&disc->disc_mutex);

	lport->tt.seq_els_rsp_send(rx_fp, ELS_LS_RJT, &rjt_data);

	fc_frame_free(rx_fp);

}
@@ -923,7 +926,7 @@ static void fc_rport_plogi_resp(struct fc_seq *sp, struct fc_frame *fp, 
	fc_frame_free(fp);

err:

	mutex_unlock(&rdata->rp_mutex);

	kref_put(&rdata->kref, rdata->local_port->tt.rport_destroy);

	kref_put(&rdata->kref, lport->tt.rport_destroy);

}



static bool
@@ -1477,14 +1480,11 @@ static void fc_rport_recv_els_req(struct fc_lport *lport, struct fc_frame *fp) 
	struct fc_rport_priv *rdata;

	struct fc_seq_els_data els_data;



	mutex_lock(&lport->disc.disc_mutex);

	rdata = lport->tt.rport_lookup(lport, fc_frame_sid(fp));

	if (!rdata) {

		mutex_unlock(&lport->disc.disc_mutex);

	if (!rdata)

		goto reject;

	}



	mutex_lock(&rdata->rp_mutex);

	mutex_unlock(&lport->disc.disc_mutex);



	switch (rdata->rp_state) {

	case RPORT_ST_PRLI:
@@ -1494,6 +1494,7 @@ static void fc_rport_recv_els_req(struct fc_lport *lport, struct fc_frame *fp) 
		break;

	default:

		mutex_unlock(&rdata->rp_mutex);

		kref_put(&rdata->kref, lport->tt.rport_destroy);

		goto reject;

	}
@@ -1524,6 +1525,7 @@ static void fc_rport_recv_els_req(struct fc_lport *lport, struct fc_frame *fp) 
	}



	mutex_unlock(&rdata->rp_mutex);

	kref_put(&rdata->kref, rdata->local_port->tt.rport_destroy);

	return;



reject:
@@ -1907,7 +1909,6 @@ static void fc_rport_recv_logo_req(struct fc_lport *lport, struct fc_frame *fp) 


	sid = fc_frame_sid(fp);



	mutex_lock(&lport->disc.disc_mutex);

	rdata = lport->tt.rport_lookup(lport, sid);

	if (rdata) {

		mutex_lock(&rdata->rp_mutex);
@@ -1916,10 +1917,10 @@ static void fc_rport_recv_logo_req(struct fc_lport *lport, struct fc_frame *fp) 


		fc_rport_enter_delete(rdata, RPORT_EV_LOGO);

		mutex_unlock(&rdata->rp_mutex);

		kref_put(&rdata->kref, rdata->local_port->tt.rport_destroy);

	} else

		FC_RPORT_ID_DBG(lport, sid,

				"Received LOGO from non-logged-in port\n");

	mutex_unlock(&lport->disc.disc_mutex);

	fc_frame_free(fp);

}