--- /dev/null
+From f33447b90e96076483525b21cc4e0a8977cdd07c Mon Sep 17 00:00:00 2001
+From: Keith Busch <keith.busch@intel.com>
+Date: Fri, 10 Feb 2017 18:15:51 -0500
+Subject: nvme/core: Fix race kicking freed request_queue
+
+From: Keith Busch <keith.busch@intel.com>
+
+commit f33447b90e96076483525b21cc4e0a8977cdd07c upstream.
+
+If a namespace has already been marked dead, we don't want to kick the
+request_queue again since we may have just freed it from another thread.
+
+Signed-off-by: Keith Busch <keith.busch@intel.com>
+Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Jens Axboe <axboe@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/nvme/host/core.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -2057,9 +2057,9 @@ void nvme_kill_queues(struct nvme_ctrl *
+ * Revalidating a dead namespace sets capacity to 0. This will
+ * end buffered writers dirtying pages that can't be synced.
+ */
+- if (ns->disk && !test_and_set_bit(NVME_NS_DEAD, &ns->flags))
+- revalidate_disk(ns->disk);
+-
++ if (!ns->disk || test_and_set_bit(NVME_NS_DEAD, &ns->flags))
++ continue;
++ revalidate_disk(ns->disk);
+ blk_set_queue_dying(ns->queue);
+ blk_mq_abort_requeue_list(ns->queue);
+ blk_mq_start_stopped_hw_queues(ns->queue, true);
--- /dev/null
+From 6db28eda266052f86a6b402422de61eeb7d2e351 Mon Sep 17 00:00:00 2001
+From: Keith Busch <keith.busch@intel.com>
+Date: Fri, 10 Feb 2017 18:15:49 -0500
+Subject: nvme/pci: Disable on removal when disconnected
+
+From: Keith Busch <keith.busch@intel.com>
+
+commit 6db28eda266052f86a6b402422de61eeb7d2e351 upstream.
+
+If the device is not present, the driver should disable the queues
+immediately. Prior to this, the driver was relying on the watchdog timer
+to kill the queues if requests were outstanding to the device, and that
+just delays removal up to one second.
+
+Signed-off-by: Keith Busch <keith.busch@intel.com>
+Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Jens Axboe <axboe@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/nvme/host/pci.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -1983,8 +1983,10 @@ static void nvme_remove(struct pci_dev *
+
+ pci_set_drvdata(pdev, NULL);
+
+- if (!pci_device_is_present(pdev))
++ if (!pci_device_is_present(pdev)) {
+ nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_DEAD);
++ nvme_dev_disable(dev, false);
++ }
+
+ flush_work(&dev->reset_work);
+ nvme_uninit_ctrl(&dev->ctrl);
--- /dev/null
+From de5540d088fe97ad583cc7d396586437b32149a5 Mon Sep 17 00:00:00 2001
+From: "Jason A. Donenfeld" <Jason@zx2c4.com>
+Date: Thu, 23 Mar 2017 12:24:43 +0100
+Subject: padata: avoid race in reordering
+
+From: Jason A. Donenfeld <Jason@zx2c4.com>
+
+commit de5540d088fe97ad583cc7d396586437b32149a5 upstream.
+
+Under extremely heavy uses of padata, crashes occur, and with list
+debugging turned on, this happens instead:
+
+[87487.298728] WARNING: CPU: 1 PID: 882 at lib/list_debug.c:33
+__list_add+0xae/0x130
+[87487.301868] list_add corruption. prev->next should be next
+(ffffb17abfc043d0), but was ffff8dba70872c80. (prev=ffff8dba70872b00).
+[87487.339011] [<ffffffff9a53d075>] dump_stack+0x68/0xa3
+[87487.342198] [<ffffffff99e119a1>] ? console_unlock+0x281/0x6d0
+[87487.345364] [<ffffffff99d6b91f>] __warn+0xff/0x140
+[87487.348513] [<ffffffff99d6b9aa>] warn_slowpath_fmt+0x4a/0x50
+[87487.351659] [<ffffffff9a58b5de>] __list_add+0xae/0x130
+[87487.354772] [<ffffffff9add5094>] ? _raw_spin_lock+0x64/0x70
+[87487.357915] [<ffffffff99eefd66>] padata_reorder+0x1e6/0x420
+[87487.361084] [<ffffffff99ef0055>] padata_do_serial+0xa5/0x120
+
+padata_reorder calls list_add_tail with the list to which its adding
+locked, which seems correct:
+
+spin_lock(&squeue->serial.lock);
+list_add_tail(&padata->list, &squeue->serial.list);
+spin_unlock(&squeue->serial.lock);
+
+This therefore leaves only place where such inconsistency could occur:
+if padata->list is added at the same time on two different threads.
+This pdata pointer comes from the function call to
+padata_get_next(pd), which has in it the following block:
+
+next_queue = per_cpu_ptr(pd->pqueue, cpu);
+padata = NULL;
+reorder = &next_queue->reorder;
+if (!list_empty(&reorder->list)) {
+ padata = list_entry(reorder->list.next,
+ struct padata_priv, list);
+ spin_lock(&reorder->lock);
+ list_del_init(&padata->list);
+ atomic_dec(&pd->reorder_objects);
+ spin_unlock(&reorder->lock);
+
+ pd->processed++;
+
+ goto out;
+}
+out:
+return padata;
+
+I strongly suspect that the problem here is that two threads can race
+on reorder list. Even though the deletion is locked, call to
+list_entry is not locked, which means it's feasible that two threads
+pick up the same padata object and subsequently call list_add_tail on
+them at the same time. The fix is thus be hoist that lock outside of
+that block.
+
+Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Acked-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/padata.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/kernel/padata.c
++++ b/kernel/padata.c
+@@ -190,19 +190,20 @@ static struct padata_priv *padata_get_ne
+
+ reorder = &next_queue->reorder;
+
++ spin_lock(&reorder->lock);
+ if (!list_empty(&reorder->list)) {
+ padata = list_entry(reorder->list.next,
+ struct padata_priv, list);
+
+- spin_lock(&reorder->lock);
+ list_del_init(&padata->list);
+ atomic_dec(&pd->reorder_objects);
+- spin_unlock(&reorder->lock);
+
+ pd->processed++;
+
++ spin_unlock(&reorder->lock);
+ goto out;
+ }
++ spin_unlock(&reorder->lock);
+
+ if (__this_cpu_read(pd->pqueue->cpu_index) == next_queue->cpu_index) {
+ padata = ERR_PTR(-ENODATA);
projects / thirdparty / kernel / stable-queue.git / commitdiff
