nvme-pci: fix NULL req in completion handler (50b7c243) · Commits · 戴 / test

Currently, we use nvmeq->q_depth as the upper limit for a valid tag in nvme_handle_cqe(), it is not correct. Because the available tag number is recorded in tagset, which is not equal to nvmeq->q_depth. The nvme driver registers interrupts for queues before initializing the tagset, because it uses the number of successful request_irq() calls to configure the tagset parameters. This allows a race condition with the current tag validity check if the controller happens to produce an interrupt with a corrupted CQE before the tagset is initialized. Replace the driver's indirect tag check with the one already provided by the block layer. Signed-off-by:

Xianting Tian <tian.xianting@h3c.com> Reviewed-by:

Keith Busch <kbusch@kernel.org> Signed-off-by:

Christoph Hellwig <hch@lst.de>

drivers/nvme/host/pci.c

+7 −7

Original line number	Diff line number	Diff line
		@@ -940,13 +940,6 @@ static inline void nvme_handle_cqe(struct nvme_queue *nvmeq, u16 idx)
		struct nvme_completion *cqe = &nvmeq->cqes[idx];
		struct request *req;

		if (unlikely(cqe->command_id >= nvmeq->q_depth)) {
		dev_warn(nvmeq->dev->ctrl.device,
		"invalid id %d completed on queue %d\n",
		cqe->command_id, le16_to_cpu(cqe->sq_id));
		return;
		}

		/*
		* AEN requests are special as they don't time out and can
		* survive any kind of queue freeze and often don't respond to
		@@ -960,6 +953,13 @@ static inline void nvme_handle_cqe(struct nvme_queue *nvmeq, u16 idx)
		}

		req = blk_mq_tag_to_rq(nvme_queue_tagset(nvmeq), cqe->command_id);
		if (unlikely(!req)) {
		dev_warn(nvmeq->dev->ctrl.device,
		"invalid id %d completed on queue %d\n",
		cqe->command_id, le16_to_cpu(cqe->sq_id));
		return;
		}

		trace_nvme_sq(req, cqe->sq_head, nvmeq->sq_tail);
		if (!nvme_try_complete_req(req, cqe->status, cqe->result))
		nvme_pci_complete_rq(req);

Admin message