scsi: libfc: hold disc_mutex in fc_disc_stop_rports()

hreinecke · martinkpetersen · commit bc3d12b75491 · 2018-07-12T23:01:16.000-04:00
fc_disc_stop_rports() is calling fc_rport_logoff(), which in turn is acquiring the rport mutex. So we cannot use RCU list traversal here, but rather need to hold the disc mutex to avoid list corruption while traversing. Fixes: a407c59 ("scsi: libfc: Fixup disc_mutex handling") Signed-off-by: Hannes Reinecke <hare@suse.com> Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
diff --git a/drivers/scsi/libfc/fc_disc.c b/drivers/scsi/libfc/fc_disc.c
@@ -62,20 +62,16 @@ static void fc_disc_restart(struct fc_disc *);
  */
 static void fc_disc_stop_rports(struct fc_disc *disc)
 {
-	struct fc_lport *lport;
 	struct fc_rport_priv *rdata;
 
-	lport = fc_disc_lport(disc);
-	lockdep_assert_held(&lport->lp_mutex);
+	lockdep_assert_held(&disc->disc_mutex);
 
-	rcu_read_lock();
-	list_for_each_entry_rcu(rdata, &disc->rports, peers) {
+	list_for_each_entry(rdata, &disc->rports, peers) {
 		if (kref_get_unless_zero(&rdata->kref)) {
 			fc_rport_logoff(rdata);
 			kref_put(&rdata->kref, fc_rport_destroy);
 		}
 	}
-	rcu_read_unlock();
 }
 
 /**
@@ -699,7 +695,9 @@ static void fc_disc_stop(struct fc_lport *lport)
 
 	if (disc->pending)
 		cancel_delayed_work_sync(&disc->disc_work);
+	mutex_lock(&disc->disc_mutex);
 	fc_disc_stop_rports(disc);
+	mutex_unlock(&disc->disc_mutex);
 }
 
 /**

Original file line number	Diff line number	Diff line change
`@@ -62,20 +62,16 @@ static void fc_disc_restart(struct fc_disc *);`
`62`	`62`	`*/`
`63`	`63`	`static void fc_disc_stop_rports(struct fc_disc *disc)`
`64`	`64`	`{`
`65`		`- struct fc_lport *lport;`
`66`	`65`	`struct fc_rport_priv *rdata;`
`67`	`66`
`68`		`- lport = fc_disc_lport(disc);`
`69`		`- lockdep_assert_held(&lport->lp_mutex);`
	`67`	`+ lockdep_assert_held(&disc->disc_mutex);`
`70`	`68`
`71`		`- rcu_read_lock();`
`72`		`- list_for_each_entry_rcu(rdata, &disc->rports, peers) {`
	`69`	`+ list_for_each_entry(rdata, &disc->rports, peers) {`
`73`	`70`	`if (kref_get_unless_zero(&rdata->kref)) {`
`74`	`71`	`fc_rport_logoff(rdata);`
`75`	`72`	`kref_put(&rdata->kref, fc_rport_destroy);`
`76`	`73`	`}`
`77`	`74`	`}`
`78`		`- rcu_read_unlock();`
`79`	`75`	`}`
`80`	`76`
`81`	`77`	`/**`
`@@ -699,7 +695,9 @@ static void fc_disc_stop(struct fc_lport *lport)`
`699`	`695`
`700`	`696`	`if (disc->pending)`
`701`	`697`	`cancel_delayed_work_sync(&disc->disc_work);`
	`698`	`+ mutex_lock(&disc->disc_mutex);`
`702`	`699`	`fc_disc_stop_rports(disc);`
	`700`	`+ mutex_unlock(&disc->disc_mutex);`
`703`	`701`	`}`
`704`	`702`
`705`	`703`	`/**`