• Maurizio Lombardi's avatar
    nvme: do not let the user delete a ctrl before a complete initialization · 2eb94dd5
    Maurizio Lombardi authored
    If a userspace application performes a "delete_controller" command
    early during the ctrl initialization, the delete operation
    may race against the init code and the kernel will crash.
    
    nvme nvme5: Connect command failed: host path error
    nvme nvme5: failed to connect queue: 0 ret=880
    PF: supervisor write access in kernel mode
    PF: error_code(0x0002) - not-present page
     blk_mq_quiesce_queue+0x18/0x90
     nvme_tcp_delete_ctrl+0x24/0x40 [nvme_tcp]
     nvme_do_delete_ctrl+0x7f/0x8b [nvme_core]
     nvme_sysfs_delete.cold+0x8/0xd [nvme_core]
     kernfs_fop_write_iter+0x124/0x1b0
     new_sync_write+0xff/0x190
     vfs_write+0x1ef/0x280
    
    Fix the crash by checking the NVME_CTRL_STARTED_ONCE bit;
    if it's not set it means that the nvme controller is still
    in the process of getting initialized and the kernel
    will return an -EBUSY error to userspace.
    Set the NVME_CTRL_STARTED_ONCE later in the nvme_start_ctrl()
    function, after the controller start operation is completed.
    Signed-off-by: default avatarMaurizio Lombardi <mlombard@redhat.com>
    Reviewed-by: default avatarSagi Grimberg <sagi@grimberg.me>
    Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
    Signed-off-by: default avatarKeith Busch <kbusch@kernel.org>
    2eb94dd5
core.c 143 KB