nvmet: Fix possible infinite loop triggered on hot namespace removal
authorSolganik Alexander <sashas@lightbitslabs.com>
Sun, 30 Oct 2016 08:35:15 +0000 (10:35 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 6 Jan 2017 09:40:14 +0000 (10:40 +0100)
commitfe3d462821b02df53e5c99b2c9b059824adbac0a
tree835e48350fcf21ef5622448ddc9ba9436505f802
parent890c39d35eb070eccad71564f55f4910668b25c4
nvmet: Fix possible infinite loop triggered on hot namespace removal

commit e4fcf07cca6a3b6c4be00df16f08be894325eaa3 upstream.

When removing a namespace we delete it from the subsystem namespaces
list with list_del_init which allows us to know if it is enabled or
not.

The problem is that list_del_init initialize the list next and does
not respect the RCU list-traversal we do on the IO path for locating
a namespace. Instead we need to use list_del_rcu which is allowed to
run concurrently with the _rcu list-traversal primitives (keeps list
next intact) and guarantees concurrent nvmet_find_naespace forward
progress.

By changing that, we cannot rely on ns->dev_link for knowing if the
namspace is enabled, so add enabled indicator entry to nvmet_ns for
that.

Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Solganik Alexander <sashas@lightbitslabs.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/nvme/target/configfs.c
drivers/nvme/target/core.c
drivers/nvme/target/nvmet.h