diff options
| author | Keith Busch <keith.busch@intel.com> | 2018-10-05 16:57:06 +0200 |
|---|---|---|
| committer | Christoph Hellwig <hch@lst.de> | 2018-10-08 11:53:42 +0200 |
| commit | 48f78be3326052a7718678ff9a78d6d884a50323 (patch) | |
| tree | b5458acfc76ba2bfebdec235efc6fc231192c252 | |
| parent | Merge branch 'nvme-4.19' of git://git.infradead.org/nvme into for-linus (diff) | |
| download | linux-48f78be3326052a7718678ff9a78d6d884a50323.tar.xz linux-48f78be3326052a7718678ff9a78d6d884a50323.zip | |
nvme: remove ns sibling before clearing path
The code had been clearing a namespace being deleted as the current
path while that namespace was still in the path siblings list. It is
possible a new IO could set that namespace back to the current path
since it appeared to be an eligable path to select, which may result in
a use-after-free error.
This patch ensures a namespace being removed is not eligable to be reset
as a current path prior to clearing it as the current path.
Signed-off-by: Keith Busch <keith.busch@intel.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Christoph Hellwig <hch@lst.de>
| -rw-r--r-- | drivers/nvme/host/core.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c index dd8ec1dd9219..6bb9908bf46f 100644 --- a/drivers/nvme/host/core.c +++ b/drivers/nvme/host/core.c @@ -3143,8 +3143,8 @@ static void nvme_ns_remove(struct nvme_ns *ns) } mutex_lock(&ns->ctrl->subsys->lock); - nvme_mpath_clear_current_path(ns); list_del_rcu(&ns->siblings); + nvme_mpath_clear_current_path(ns); mutex_unlock(&ns->ctrl->subsys->lock); down_write(&ns->ctrl->namespaces_rwsem); |