nvmet: Fix possible infinite loop triggered on hot namespace removal
authorSolganik Alexander <sashas@lightbitslabs.com>
Sun, 30 Oct 2016 08:35:15 +0000 (10:35 +0200)
committerSagi Grimberg <sagi@grimberg.me>
Tue, 6 Dec 2016 08:17:03 +0000 (10:17 +0200)
commite4fcf07cca6a3b6c4be00df16f08be894325eaa3
treefe89e5c2ba76c318026e6b708bc73060f9c4902f
parentf3116d8f1e110a5eeaac94f5d1c490e9e466a223
nvmet: Fix possible infinite loop triggered on hot namespace removal

When removing a namespace we delete it from the subsystem namespaces
list with list_del_init which allows us to know if it is enabled or
not.

The problem is that list_del_init initialize the list next and does
not respect the RCU list-traversal we do on the IO path for locating
a namespace. Instead we need to use list_del_rcu which is allowed to
run concurrently with the _rcu list-traversal primitives (keeps list
next intact) and guarantees concurrent nvmet_find_naespace forward
progress.

By changing that, we cannot rely on ns->dev_link for knowing if the
namspace is enabled, so add enabled indicator entry to nvmet_ns for
that.

Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Solganik Alexander <sashas@lightbitslabs.com>
Cc: <stable@vger.kernel.org> # v4.8+
drivers/nvme/target/configfs.c
drivers/nvme/target/core.c
drivers/nvme/target/nvmet.h