nvme: fix the dangerous reference of namespaces list

nvme_remove_namespaces and nvme_remove_invalid_namespaces reference
the ctrl->namespaces list w/o holding namespaces_mutext. It is ok
to invoke nvme_ns_remove there, but what if there is others.

To be safer, reference the ctrl->namespaces list under
namespaces_mutext.

Reviewed-by: Keith Busch <keith.busch@intel.com>
Signed-off-by: Jianchao Wang <jianchao.w.wang@oracle.com>
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index f96b9935691716d6a8fbf837cedec0036a333003..31f20f4643cfe4e4ee4568f07ecf504d2c3637f3 100644 (file)
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -3098,11 +3098,18 @@ static void nvme_remove_invalid_namespaces(struct nvme_ctrl *ctrl,
                                        unsigned nsid)
 {
        struct nvme_ns *ns, *next;
+       LIST_HEAD(rm_list);
 
+       mutex_lock(&ctrl->namespaces_mutex);
        list_for_each_entry_safe(ns, next, &ctrl->namespaces, list) {
                if (ns->head->ns_id > nsid)
-                       nvme_ns_remove(ns);
+                       list_move_tail(&ns->list, &rm_list);
        }
+       mutex_unlock(&ctrl->namespaces_mutex);
+
+       list_for_each_entry_safe(ns, next, &rm_list, list)
+               nvme_ns_remove(ns);
+
 }
 
 static int nvme_scan_ns_list(struct nvme_ctrl *ctrl, unsigned nn)
@@ -3202,6 +3209,7 @@ EXPORT_SYMBOL_GPL(nvme_queue_scan);
 void nvme_remove_namespaces(struct nvme_ctrl *ctrl)
 {
        struct nvme_ns *ns, *next;
+       LIST_HEAD(ns_list);
 
        /*
         * The dead states indicates the controller was not gracefully
@@ -3212,7 +3220,11 @@ void nvme_remove_namespaces(struct nvme_ctrl *ctrl)
        if (ctrl->state == NVME_CTRL_DEAD)
                nvme_kill_queues(ctrl);
 
-       list_for_each_entry_safe(ns, next, &ctrl->namespaces, list)
+       mutex_lock(&ctrl->namespaces_mutex);
+       list_splice_init(&ctrl->namespaces, &ns_list);
+       mutex_unlock(&ctrl->namespaces_mutex);
+
+       list_for_each_entry_safe(ns, next, &ns_list, list)
                nvme_ns_remove(ns);
 }
 EXPORT_SYMBOL_GPL(nvme_remove_namespaces);