Commit d6f66210 authored by Chao Leng's avatar Chao Leng Committed by Christoph Hellwig
Browse files

nvme-tcp: avoid race between time out and tear down 



Now use teardown_lock to serialize for time out and tear down. This may
cause abnormal: first cancel all request in tear down, then time out may
complete the request again, but the request may already be freed or
restarted.

To avoid race between time out and tear down, in tear down process,
first we quiesce the queue, and then delete the timer and cancel
the time out work for the queue. At the same time we need to delete
teardown_lock.

Signed-off-by: default avatarChao Leng <lengchao@huawei.com>
Reviewed-by: default avatarSagi Grimberg <sagi@grimberg.me>
Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
parent 3017013d

drivers/nvme/host/tcp.c

+3 −11
Original line number Diff line number Diff line
@@ -124,7 +124,6 @@ struct nvme_tcp_ctrl { 
	struct sockaddr_storage src_addr;

	struct nvme_ctrl	ctrl;



	struct mutex		teardown_lock;

	struct work_struct	err_work;

	struct delayed_work	connect_work;

	struct nvme_tcp_request async_req;
@@ -1886,8 +1885,8 @@ out_free_queue: 
static void nvme_tcp_teardown_admin_queue(struct nvme_ctrl *ctrl,

		bool remove)

{

	mutex_lock(&to_tcp_ctrl(ctrl)->teardown_lock);

	blk_mq_quiesce_queue(ctrl->admin_q);

	blk_sync_queue(ctrl->admin_q);

	nvme_tcp_stop_queue(ctrl, 0);

	if (ctrl->admin_tagset) {

		blk_mq_tagset_busy_iter(ctrl->admin_tagset,
@@ -1897,18 +1896,17 @@ static void nvme_tcp_teardown_admin_queue(struct nvme_ctrl *ctrl, 
	if (remove)

		blk_mq_unquiesce_queue(ctrl->admin_q);

	nvme_tcp_destroy_admin_queue(ctrl, remove);

	mutex_unlock(&to_tcp_ctrl(ctrl)->teardown_lock);

}



static void nvme_tcp_teardown_io_queues(struct nvme_ctrl *ctrl,

		bool remove)

{

	mutex_lock(&to_tcp_ctrl(ctrl)->teardown_lock);

	if (ctrl->queue_count <= 1)

		goto out;

		return;

	blk_mq_quiesce_queue(ctrl->admin_q);

	nvme_start_freeze(ctrl);

	nvme_stop_queues(ctrl);

	nvme_sync_io_queues(ctrl);

	nvme_tcp_stop_io_queues(ctrl);

	if (ctrl->tagset) {

		blk_mq_tagset_busy_iter(ctrl->tagset,
@@ -1918,8 +1916,6 @@ static void nvme_tcp_teardown_io_queues(struct nvme_ctrl *ctrl, 
	if (remove)

		nvme_start_queues(ctrl);

	nvme_tcp_destroy_io_queues(ctrl, remove);

out:

	mutex_unlock(&to_tcp_ctrl(ctrl)->teardown_lock);

}



static void nvme_tcp_reconnect_or_remove(struct nvme_ctrl *ctrl)
@@ -2171,14 +2167,11 @@ static void nvme_tcp_complete_timed_out(struct request *rq) 
	struct nvme_tcp_request *req = blk_mq_rq_to_pdu(rq);

	struct nvme_ctrl *ctrl = &req->queue->ctrl->ctrl;



	/* fence other contexts that may complete the command */

	mutex_lock(&to_tcp_ctrl(ctrl)->teardown_lock);

	nvme_tcp_stop_queue(ctrl, nvme_tcp_queue_id(req->queue));

	if (!blk_mq_request_completed(rq)) {

		nvme_req(rq)->status = NVME_SC_HOST_ABORTED_CMD;

		blk_mq_complete_request(rq);

	}

	mutex_unlock(&to_tcp_ctrl(ctrl)->teardown_lock);

}



static enum blk_eh_timer_return
@@ -2455,7 +2448,6 @@ static struct nvme_ctrl *nvme_tcp_create_ctrl(struct device *dev, 
			nvme_tcp_reconnect_ctrl_work);

	INIT_WORK(&ctrl->err_work, nvme_tcp_error_recovery_work);

	INIT_WORK(&ctrl->ctrl.reset_work, nvme_reset_ctrl_work);

	mutex_init(&ctrl->teardown_lock);



	if (!(opts->mask & NVMF_OPT_TRSVCID)) {

		opts->trsvcid =

CRA Git | Maintained and supported by SUSTech CRA and CCSE