kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
linux/drivers/nvme/host
History
Sagi Grimberg b23accd11a nvme-tcp: Fix possible race of io_work and direct send 
commit 5c11f7d9f8 upstream.

We may send a request (with or without its data) from two paths:

  1. From our I/O context nvme_tcp_io_work which is triggered from:
    - queue_rq
    - r2t reception
    - socket data_ready and write_space callbacks
  2. Directly from queue_rq if the send_list is empty (because we want to
     save the context switch associated with scheduling our io_work).

However, given that now we have the send_mutex, we may run into a race
condition where none of these contexts will send the pending payload to
the controller. Both io_work send path and queue_rq send path
opportunistically attempt to acquire the send_mutex however queue_rq only
attempts to send a single request, and if io_work context fails to
acquire the send_mutex it will complete without rescheduling itself.

The race can trigger with the following sequence:

  1. queue_rq sends request (no incapsule data) and blocks
  2. RX path receives r2t - prepares data PDU to send, adds h2cdata PDU
     to the send_list and schedules io_work
  3. io_work triggers and cannot acquire the send_mutex - because of (1),
     ends without self rescheduling
  4. queue_rq completes the send, and completes

==> no context will send the h2cdata - timeout.

Fix this by having queue_rq sending as much as it can from the send_list
such that if it still has any left, its because the socket buffer is
full and the socket write_space callback will trigger, thus guaranteeing
that a context will be scheduled to send the h2cdata PDU.

Fixes: db5ad6b7f8 ("nvme-tcp: try to send request in queue_rq context")
Reported-by: Potnuri Bharat Teja <bharat@chelsio.com>
Reported-by: Samuel Jones <sjones@kalrayinc.com>
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Tested-by: Potnuri Bharat Teja <bharat@chelsio.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2021-01-17 14:17:03 +01:00
..
core.c nvme: fix memory leak freeing command effects 2020-11-14 09:57:55 +01:00
fabrics.c nvme-fabrics: allow to queue requests for live queues 2020-09-09 08:00:50 +02:00
fabrics.h nvme: fix deadlock in disconnect during scan_work and/or ana_work 2020-07-29 07:45:19 +02:00
fault_inject.c nvme: enable to inject errors into admin commands 2019-06-21 11:15:50 +02:00
fc.c nvme-fc: remove nvme_fc_terminate_io() 2020-10-27 10:02:29 +01:00
fc.h nvme-fc: Update header and host for common definitions for LS handling 2020-05-09 16:18:33 -06:00
hwmon.c nvme: return errors for hwmon init 2020-09-22 17:49:55 +02:00
Kconfig nvme-tcp: fix kconfig dependency warning when !CRYPTO 2020-09-15 07:58:49 +02:00
lightnvm.c nvme: support for multiple Command Sets Supported and Effects log pages 2020-07-08 16:16:20 +02:00
Makefile nvme: support for zoned namespaces 2020-07-08 16:16:20 +02:00
multipath.c bdi: replace BDI_CAP_STABLE_WRITES with a queue and a sb flag 2020-09-24 13:43:39 -06:00
nvme.h nvme: directly cache command effects log 2020-11-14 09:57:55 +01:00
pci.c nvme: free sq/cq dbbuf pointers when dbbuf set fails 2020-11-14 09:57:55 +01:00
rdma.c nvme fixes for 5.10: 2020-11-05 07:10:50 -07:00
tcp.c nvme-tcp: Fix possible race of io_work and direct send 2021-01-17 14:17:03 +01:00
trace.c nvme: trace: parse Get LBA Status command in detail 2019-08-29 12:55:01 -07:00
trace.h nvme-trace: print result and status in hex format 2019-06-21 11:12:37 +02:00
zns.c nvme: remove the disk argument to nvme_update_zone_info 2020-10-07 07:56:17 +02:00