lkml.org 
[lkml]   [2018]   [Nov]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.18 044/350] nvme: remove ns sibling before clearing path
    Date
    4.18-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Keith Busch <keith.busch@intel.com>

    [ Upstream commit 48f78be3326052a7718678ff9a78d6d884a50323 ]

    The code had been clearing a namespace being deleted as the current
    path while that namespace was still in the path siblings list. It is
    possible a new IO could set that namespace back to the current path
    since it appeared to be an eligable path to select, which may result in
    a use-after-free error.

    This patch ensures a namespace being removed is not eligable to be reset
    as a current path prior to clearing it as the current path.

    Signed-off-by: Keith Busch <keith.busch@intel.com>
    Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
    Signed-off-by: Christoph Hellwig <hch@lst.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/nvme/host/core.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/drivers/nvme/host/core.c
    +++ b/drivers/nvme/host/core.c
    @@ -3119,8 +3119,8 @@ static void nvme_ns_remove(struct nvme_n
    }

    mutex_lock(&ns->ctrl->subsys->lock);
    - nvme_mpath_clear_current_path(ns);
    list_del_rcu(&ns->siblings);
    + nvme_mpath_clear_current_path(ns);
    mutex_unlock(&ns->ctrl->subsys->lock);

    down_write(&ns->ctrl->namespaces_rwsem);

    \
     
     \ /
      Last update: 2018-11-12 00:42    [W:4.069 / U:0.044 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site