From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE, SPF_PASS,UNPARSEABLE_RELAY,USER_AGENT_GIT autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2FAD6C43331 for ; Tue, 24 Mar 2020 15:31:22 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id DEA8720774 for ; Tue, 24 Mar 2020 15:31:21 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="SMbb2wAy" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org DEA8720774 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=mellanox.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-nvme-bounces+linux-nvme=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date: Subject:To:From:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To: References:List-Owner; bh=L1wf5OSuvBpWqThWWqzeMU4xbZF8us1aWnGwPrFoa6k=; b=SMb b2wAy6N1PhnLw6XO/JHrWkby6OmN5Pcsg2KtXKSi1XHS0UclE6L4jcpgIwKT5o7Y0M9Rz+u6kIyOE tRK1WCiuNxCxCGTwePA6TZTpCbtdIK29mfE7AOa44qXQCHfJ8c2vHNJHQ3TvX+C2u2g+XK8N9SrZs ehZ7eT8htsemBG4vy8+tQX4Nl0QiEDM3murqfaQxiLvMxBmsjJ2jQlwHAy2ShVq4R/VZD/HPI1sjd SuPHIoUbvFwpn/6pLLRB6c/sHwk9E1MsJXHoWzoquY+eusBzI5tywRcsCJYqoOWMbWOb9BWkRh2pH mvoZDw8avbnw04bHodjaSYAGp9odV0w==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.92.3 #3 (Red Hat Linux)) id 1jGlWQ-0005yd-P6; Tue, 24 Mar 2020 15:31:18 +0000 Received: from mail-il-dmz.mellanox.com ([193.47.165.129] helo=mellanox.co.il) by bombadil.infradead.org with esmtp (Exim 4.92.3 #3 (Red Hat Linux)) id 1jGlV6-0003io-PZ for linux-nvme@lists.infradead.org; Tue, 24 Mar 2020 15:30:00 +0000 Received: from Internal Mail-Server by MTLPINE1 (envelope-from israelr@mellanox.com) with ESMTPS (AES256-SHA encrypted); 24 Mar 2020 17:29:47 +0200 Received: from rsws50.mtr.labs.mlnx (rsws50.mtr.labs.mlnx [10.209.40.61]) by labmailer.mlnx (8.13.8/8.13.8) with ESMTP id 02OFTkEK013985; Tue, 24 Mar 2020 17:29:46 +0200 From: Israel Rukshin To: Linux-nvme , Sagi Grimberg , Christoph Hellwig Subject: [PATCH 0/7 V3] nvme: Fixes for deleting a ctrl before it was created Date: Tue, 24 Mar 2020 17:29:38 +0200 Message-Id: <1585063785-14268-1-git-send-email-israelr@mellanox.com> X-Mailer: git-send-email 1.8.4.3 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20200324_082957_223290_8AF56146 X-CRM114-Status: GOOD ( 10.06 ) X-BeenThere: linux-nvme@lists.infradead.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Shlomi Nimrodi , Israel Rukshin , Max Gurtovoy MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-nvme" Errors-To: linux-nvme-bounces+linux-nvme=archiver.kernel.org@lists.infradead.org The patchset starts with small cleanups, continue with the fixs and ends with adding new warnings. Calling nvme_sysfs_delete() when the controller is in the middle of creation may cause several bugs. If the controller is in NEW state we remove delete_controller file and don't delete the controller. The user will not be able to use nvme disconnect command on that controller again, although the controller may be active. Other bugs may happen if the controller is in the middle of create_ctrl callback and nvme_do_delete_ctrl() starts. For example, freeing I/O tagset at nvme_do_delete_ctrl() before it was created or controller use after free at create_ctrl callback. Changes from v2: - Added Reviewed-by signatures - Patches reordering - Don't move the calls from the ->remove PCI driver method to the nvme_ctrl_ops ->free_ctrl method ((Patch 2/7)) - Add more details to commit message (Patch 3/7) - Split patch "Fix ctrl use-after-free during sysfs deletion" (Patches 3/7 and 4/7) Changes from v1: - Added Reviewed-by signatures - Patches reordering - New patches (2/6 and 3/6) - Split to 2 WARN_ON_ONCE (Patches 5/6 and 6/6) Israel Rukshin (7): nvme: Remove unused return code from nvme_delete_ctrl_sync nvme-pci: Re-order nvme_pci_free_ctrl nvme: Fix ctrl use-after-free during sysfs deletion nvme: Make nvme_uninit_ctrl symmetric to nvme_init_ctrl nvme: Fix controller creation races with teardown flow nvme-rdma: Add warning on state change failure at nvme_rdma_setup_ctrl nvme-tcp: Add warning on state change failure at nvme_tcp_setup_ctrl drivers/nvme/host/core.c | 18 ++++++++++-------- drivers/nvme/host/fc.c | 3 --- drivers/nvme/host/nvme.h | 1 + drivers/nvme/host/pci.c | 8 +++----- drivers/nvme/host/rdma.c | 9 ++++++--- drivers/nvme/host/tcp.c | 9 ++++++--- drivers/nvme/target/loop.c | 3 --- 7 files changed, 26 insertions(+), 25 deletions(-) -- 1.8.3.1 _______________________________________________ linux-nvme mailing list linux-nvme@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-nvme