diff options
| author | Jens Axboe <axboe@fb.com> | 2014-12-12 16:53:40 +0100 |
|---|---|---|
| committer | Jens Axboe <axboe@fb.com> | 2014-12-12 16:53:40 +0100 |
| commit | 849c6e7746e4f6317ace6aa7d2fcdcd844e99ddb (patch) | |
| tree | a46e807ce51483393beb9e1d8c1ed331e9a023ca /drivers/block | |
| parent | NVMe: fix retry/error logic in nvme_queue_rq() (diff) | |
| download | linux-849c6e7746e4f6317ace6aa7d2fcdcd844e99ddb.tar.xz linux-849c6e7746e4f6317ace6aa7d2fcdcd844e99ddb.zip | |
NVMe: fix race condition in nvme_submit_sync_cmd()
If we have a race between the schedule timing out and the command
completing, we could have the task issuing the command exit
nvme_submit_sync_cmd() while the irq is running sync_completion().
If that happens, we could be corrupting memory, since the stack
that held 'cmdinfo' is no longer valid.
Fix this by always calling nvme_abort_cmd_info(). Once that call
completes, we know that we have either run sync_completion() if
the completion came in, or that we will never run it since we now
have special_completion() as the command callback handler.
Acked-by: Keith Busch <keith.busch@intel.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
Diffstat (limited to 'drivers/block')
| -rw-r--r-- | drivers/block/nvme-core.c | 15 |
1 files changed, 11 insertions, 4 deletions
diff --git a/drivers/block/nvme-core.c b/drivers/block/nvme-core.c index e92bdf4c68fc..b1d5d8797315 100644 --- a/drivers/block/nvme-core.c +++ b/drivers/block/nvme-core.c @@ -804,12 +804,19 @@ static int nvme_submit_sync_cmd(struct request *req, struct nvme_command *cmd, nvme_finish_cmd(nvmeq, req->tag, NULL); set_current_state(TASK_RUNNING); } - schedule_timeout(timeout); + ret = schedule_timeout(timeout); - if (cmdinfo.status == -EINTR) { - nvme_abort_cmd_info(nvmeq, blk_mq_rq_to_pdu(req)); + /* + * Ensure that sync_completion has either run, or that it will + * never run. + */ + nvme_abort_cmd_info(nvmeq, blk_mq_rq_to_pdu(req)); + + /* + * We never got the completion + */ + if (cmdinfo.status == -EINTR) return -EINTR; - } if (result) *result = cmdinfo.result; |