From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: "Ewan D. Milne" <emilne@redhat.com>,
"Martin K . Petersen" <martin.petersen@oracle.com>,
Sasha Levin <sashal@kernel.org>,
linux-scsi@vger.kernel.org
Subject: [PATCH AUTOSEL 4.20 52/77] scsi: lpfc: nvmet: avoid hang / use-after-free when destroying targetport
Date: Thu, 14 Feb 2019 21:08:30 -0500 [thread overview]
Message-ID: <20190215020855.176727-52-sashal@kernel.org> (raw)
In-Reply-To: <20190215020855.176727-1-sashal@kernel.org>
From: "Ewan D. Milne" <emilne@redhat.com>
[ Upstream commit c41f59884be5cca293ed61f3d64637dbba3a6381 ]
We cannot wait on a completion object in the lpfc_nvme_targetport structure
in the _destroy_targetport() code path because the NVMe/fc transport will
free that structure immediately after the .targetport_delete() callback.
This results in a use-after-free, and a hang if slub_debug=FZPU is enabled.
Fix this by putting the completion on the stack.
Signed-off-by: Ewan D. Milne <emilne@redhat.com>
Acked-by: James Smart <james.smart@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/lpfc/lpfc_nvmet.c | 8 +++++---
drivers/scsi/lpfc/lpfc_nvmet.h | 2 +-
2 files changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c
index 6245f442d784..95fee83090eb 100644
--- a/drivers/scsi/lpfc/lpfc_nvmet.c
+++ b/drivers/scsi/lpfc/lpfc_nvmet.c
@@ -1003,7 +1003,8 @@ lpfc_nvmet_targetport_delete(struct nvmet_fc_target_port *targetport)
struct lpfc_nvmet_tgtport *tport = targetport->private;
/* release any threads waiting for the unreg to complete */
- complete(&tport->tport_unreg_done);
+ if (tport->phba->targetport)
+ complete(tport->tport_unreg_cmp);
}
static void
@@ -1692,6 +1693,7 @@ lpfc_nvmet_destroy_targetport(struct lpfc_hba *phba)
struct lpfc_nvmet_tgtport *tgtp;
struct lpfc_queue *wq;
uint32_t qidx;
+ DECLARE_COMPLETION_ONSTACK(tport_unreg_cmp);
if (phba->nvmet_support == 0)
return;
@@ -1701,9 +1703,9 @@ lpfc_nvmet_destroy_targetport(struct lpfc_hba *phba)
wq = phba->sli4_hba.nvme_wq[qidx];
lpfc_nvmet_wqfull_flush(phba, wq, NULL);
}
- init_completion(&tgtp->tport_unreg_done);
+ tgtp->tport_unreg_cmp = &tport_unreg_cmp;
nvmet_fc_unregister_targetport(phba->targetport);
- wait_for_completion_timeout(&tgtp->tport_unreg_done, 5);
+ wait_for_completion_timeout(&tport_unreg_cmp, 5);
lpfc_nvmet_cleanup_io_context(phba);
}
phba->targetport = NULL;
diff --git a/drivers/scsi/lpfc/lpfc_nvmet.h b/drivers/scsi/lpfc/lpfc_nvmet.h
index 1aaff63f1f41..0ec1082ce7ef 100644
--- a/drivers/scsi/lpfc/lpfc_nvmet.h
+++ b/drivers/scsi/lpfc/lpfc_nvmet.h
@@ -34,7 +34,7 @@
/* Used for NVME Target */
struct lpfc_nvmet_tgtport {
struct lpfc_hba *phba;
- struct completion tport_unreg_done;
+ struct completion *tport_unreg_cmp;
/* Stats counters - lpfc_nvmet_unsol_ls_buffer */
atomic_t rcv_ls_req_in;
--
2.19.1
next prev parent reply other threads:[~2019-02-15 2:38 UTC|newest]
Thread overview: 92+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-02-15 2:07 [PATCH AUTOSEL 4.20 01/77] drm/msm: Unblock writer if reader closes file Sasha Levin
2019-02-15 2:07 ` [PATCH AUTOSEL 4.20 02/77] ASoC: Intel: Haswell/Broadwell: fix setting for .dynamic field Sasha Levin
2019-02-15 2:07 ` [PATCH AUTOSEL 4.20 03/77] ALSA: compress: prevent potential divide by zero bugs Sasha Levin
2019-02-15 2:07 ` [PATCH AUTOSEL 4.20 04/77] ASoC: rt5682: Fix recording no sound issue Sasha Levin
2019-02-15 2:07 ` [PATCH AUTOSEL 4.20 05/77] ASoC: Variable "val" in function rt274_i2c_probe() could be uninitialized Sasha Levin
2019-02-15 2:07 ` [PATCH AUTOSEL 4.20 06/77] ASoC: soc-core: defer card probe until all component is added to list Sasha Levin
2019-02-15 11:57 ` Mark Brown
2019-02-27 17:31 ` Sasha Levin
2019-02-15 2:07 ` [PATCH AUTOSEL 4.20 07/77] clk: tegra: dfll: Fix a potential Oop in remove() Sasha Levin
2019-02-15 2:07 ` [PATCH AUTOSEL 4.20 08/77] clk: sysfs: fix invalid JSON in clk_dump Sasha Levin
2019-02-15 2:07 ` [PATCH AUTOSEL 4.20 09/77] clk: vc5: Abort clock configuration without upstream clock Sasha Levin
2019-02-15 2:07 ` [PATCH AUTOSEL 4.20 10/77] ASoC: soc-core: Hold client_mutex around soc_init_dai_link() Sasha Levin
2019-02-15 11:57 ` Mark Brown
2019-02-27 17:31 ` Sasha Levin
2019-02-15 2:07 ` [PATCH AUTOSEL 4.20 11/77] thermal: int340x_thermal: Fix a NULL vs IS_ERR() check Sasha Levin
2019-02-15 2:07 ` [PATCH AUTOSEL 4.20 12/77] usb: dwc3: gadget: synchronize_irq dwc irq in suspend Sasha Levin
2019-02-15 2:07 ` [PATCH AUTOSEL 4.20 13/77] usb: dwc3: gadget: Fix the uninitialized link_state when udc starts Sasha Levin
2019-02-15 2:07 ` [PATCH AUTOSEL 4.20 14/77] usb: gadget: Potential NULL dereference on allocation error Sasha Levin
2019-02-15 2:07 ` [PATCH AUTOSEL 4.20 15/77] HID: i2c-hid: Disable runtime PM on Goodix touchpad Sasha Levin
2019-02-15 2:07 ` [PATCH AUTOSEL 4.20 16/77] ASoC: soc-core: fix init platform memory handling Sasha Levin
2019-02-15 11:58 ` Mark Brown
2019-02-27 17:34 ` Sasha Levin
2019-02-15 2:07 ` [PATCH AUTOSEL 4.20 17/77] ASoC: core: Make snd_soc_find_component() more robust Sasha Levin
2019-02-15 2:07 ` [PATCH AUTOSEL 4.20 18/77] selftests: rtc: rtctest: fix alarm tests Sasha Levin
2019-02-15 2:07 ` [PATCH AUTOSEL 4.20 19/77] selftests: rtc: rtctest: add alarm test on minute boundary Sasha Levin
2019-02-15 2:07 ` [PATCH AUTOSEL 4.20 20/77] genirq: Make sure the initial affinity is not empty Sasha Levin
2019-02-15 2:07 ` [PATCH AUTOSEL 4.20 21/77] x86/mm/mem_encrypt: Fix erroneous sizeof() Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 22/77] ASoC: core: Don't defer probe on optional, NULL components Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 23/77] ASoC: rt5682: Fix PLL source register definitions Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 24/77] ASoC: dapm: change snprintf to scnprintf for possible overflow Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 25/77] ASoC: imx-audmux: " Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 26/77] selftests/vm/gup_benchmark.c: match gup struct to kernel Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 27/77] phy: ath79-usb: Fix the power on error path Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 28/77] phy: ath79-usb: Fix the main reset name to match the DT binding Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 29/77] selftests: seccomp: use LDLIBS instead of LDFLAGS Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 30/77] selftests: gpio-mockup-chardev: Check asprintf() for error Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 31/77] irqchip/gic-v3-mbi: Fix uninitialized mbi_lock Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 32/77] ARC: fix __ffs return value to avoid build warnings Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 33/77] ARC: show_regs: lockdep: avoid page allocator Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 34/77] drivers: thermal: int340x_thermal: Fix sysfs race condition Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 35/77] staging: rtl8723bs: Fix build error with Clang when inlining is disabled Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 36/77] mac80211: fix miscounting of ttl-dropped frames Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 37/77] sched/wait: Fix rcuwait_wake_up() ordering Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 38/77] sched/wake_q: Fix wakeup ordering for wake_q Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 39/77] futex: Fix (possible) missed wakeup Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 40/77] locking/rwsem: " Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 41/77] libceph: avoid KEEPALIVE_PENDING races in ceph_con_keepalive() Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 42/77] dm: fix clone_bio() to trigger blk_recount_segments() Sasha Levin
2019-02-15 3:49 ` Mike Snitzer
2019-02-27 17:38 ` Sasha Levin
2019-02-27 18:48 ` Mike Snitzer
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 43/77] drm/amd/powerplay: OD setting fix on Vega10 Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 44/77] tty: serial: qcom_geni_serial: Allow mctrl when flow control is disabled Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 45/77] serial: fsl_lpuart: fix maximum acceptable baud rate with over-sampling Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 46/77] drm/sun4i: hdmi: Fix usage of TMDS clock Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 47/77] staging: android: ion: Support cpu access during dma_buf_detach Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 48/77] direct-io: allow direct writes to empty inodes Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 49/77] block: cover another queue enter recursion via BIO_QUEUE_ENTERED Sasha Levin
2019-02-15 2:24 ` Tetsuo Handa
2019-02-15 2:28 ` Ming Lei
2019-02-27 17:39 ` Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 50/77] writeback: synchronize sync(2) against cgroup writeback membership switches Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 51/77] scsi: lpfc: nvme: avoid hang / use-after-free when destroying localport Sasha Levin
2019-02-15 2:08 ` Sasha Levin [this message]
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 53/77] scsi: csiostor: fix NULL pointer dereference in csio_vport_set_state() Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 54/77] net: altera_tse: fix connect_local_phy error path Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 55/77] hv_netvsc: Fix ethtool change hash key error Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 56/77] hv_netvsc: Refactor assignments of struct netvsc_device_info Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 57/77] hv_netvsc: Fix hash key value reset after other ops Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 58/77] sfc: suppress duplicate nvmem partition types in efx_ef10_mtd_probe Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 59/77] ax25: fix possible use-after-free Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 60/77] nvme-rdma: fix timeout handler Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 61/77] nvme-multipath: drop optimization for static ANA group IDs Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 62/77] cifs: fix memory leak of an allocated cifs_ntsd structure Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 63/77] drm/msm: Fix A6XX support for opp-level Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 64/77] drm/msm: avoid unused function warning Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 65/77] CIFS: Do not assume one credit for async responses Sasha Levin
2019-02-15 20:10 ` Pavel Shilovskiy
2019-02-27 17:54 ` Sasha Levin
2019-02-27 19:39 ` Pavel Shilovsky
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 66/77] CIFS: Fix mounts if the client is low on credits Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 67/77] net: usb: asix: ax88772_bind return error when hw_reset fail Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 68/77] net: dev_is_mac_header_xmit() true for ARPHRD_RAWIP Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 69/77] ibmveth: Do not process frames after calling napi_reschedule Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 70/77] mac80211: don't initiate TDLS connection if station is not associated to AP Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 71/77] mac80211: Add attribute aligned(2) to struct 'action' Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 72/77] cfg80211: extend range deviation for DMG Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 73/77] svm: Fix AVIC incomplete IPI emulation Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 74/77] KVM: nSVM: clear events pending from svm_complete_interrupts() when exiting to L1 Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 75/77] kvm: selftests: Fix region overlap check in kvm_util Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 76/77] KVM: selftests: check returned evmcs version range Sasha Levin
2019-02-15 2:08 ` [PATCH AUTOSEL 4.20 77/77] Revert "block: cover another queue enter recursion via BIO_QUEUE_ENTERED" Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190215020855.176727-52-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=emilne@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-scsi@vger.kernel.org \
--cc=martin.petersen@oracle.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome