nvme: Fix ctrl use-after-free during sysfs deletion
authorIsrael Rukshin <israelr@mellanox.com>
Tue, 24 Mar 2020 15:29:41 +0000 (17:29 +0200)
committerKeith Busch <kbusch@kernel.org>
Wed, 25 Mar 2020 19:51:56 +0000 (04:51 +0900)
commitb780d7415aacec855e2f2370cbf98f918b224903
treec1ba48f4e31b554716d16cf8c4db24f831957fab
parent253fd4ac806896293c9b9d12c794195447bad164
nvme: Fix ctrl use-after-free during sysfs deletion

In case nvme_sysfs_delete() is called by the user before taking the ctrl
reference count, the ctrl may be freed during the creation and cause the
bug. Take the reference as soon as the controller is externally visible,
which is done by cdev_device_add() in nvme_init_ctrl(). Also take the
reference count at the core layer instead of taking it on each transport
separately.

Signed-off-by: Israel Rukshin <israelr@mellanox.com>
Reviewed-by: Max Gurtovoy <maxg@mellanox.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Keith Busch <kbusch@kernel.org>
drivers/nvme/host/core.c
drivers/nvme/host/fc.c
drivers/nvme/host/pci.c
drivers/nvme/host/rdma.c
drivers/nvme/host/tcp.c
drivers/nvme/target/loop.c