[PATCH 18/23] nvmet: fix nvmet_ns::device_path access using nvmet_subsys::lock

[Nilay Shroff]

The nvmet_ns::device_path field is protected by nvmet_subsys::lock.
However, nvmet_ns_device_path_show() accesses ns->device_path without
holding the corresponding lock, triggering a Clang context analyzer
error:

drivers/nvme/target/configfs.c:535:50: error: reading variable 'device_path' requires holding mutex 'to_nvmet_ns(item).subsys->lock'
      [-Werror,-Wthread-safety-analysis]
  535 |         return sprintf(page, "%s\n", to_nvmet_ns(item)->device_path);
      |                                                         ^

Fix this by acquiring ns->subsys->lock before accessing ns->device_path
in nvmet_ns_device_path_show().

Additionally, nvmet_ns_free() frees ns->device_path without holding
subsys->lock, triggering another context analyzer error:

drivers/nvme/target/core.c:737:12: error: reading variable 'device_path' requires holding mutex 'ns->subsys->lock'
      [-Werror,-Wthread-safety-analysis]
  737 |         kfree(ns->device_path);
      |                   ^

Fix the above error, by moving the kfree() call into the existing
subsys->lock critical section to ensure that the field is accessed
while holding the required lock.

Signed-off-by: Nilay Shroff <nilay at linux.ibm.com>
---
 drivers/nvme/target/configfs.c | 9 ++++++++-
 drivers/nvme/target/core.c     | 2 +-
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/nvme/target/configfs.c b/drivers/nvme/target/configfs.c
index ba44d404ad56..a87917381093 100644
--- a/drivers/nvme/target/configfs.c
+++ b/drivers/nvme/target/configfs.c
@@ -531,7 +531,14 @@ CONFIGFS_ATTR(nvmet_, addr_tsas);
  */
 static ssize_t nvmet_ns_device_path_show(struct config_item *item, char *page)
 {
-	return sprintf(page, "%s\n", to_nvmet_ns(item)->device_path);
+	struct nvmet_ns *ns = to_nvmet_ns(item);
+	ssize_t ret;
+
+	mutex_lock(&ns->subsys->lock);
+	ret = sprintf(page, "%s\n", ns->device_path);
+	mutex_unlock(&ns->subsys->lock);
+
+	return ret;
 }
 
 static ssize_t nvmet_ns_device_path_store(struct config_item *item,
diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
index 805b5f70eb06..6b11beb2e2b2 100644
--- a/drivers/nvme/target/core.c
+++ b/drivers/nvme/target/core.c
@@ -730,13 +730,13 @@ void nvmet_ns_free(struct nvmet_ns *ns)
 		subsys->max_nsid = nvmet_max_nsid(subsys);
 
 	subsys->nr_namespaces--;
+	kfree(ns->device_path);
 	mutex_unlock(&subsys->lock);
 
 	down_write(&nvmet_ana_sem);
 	nvmet_ana_group_enabled[ns->anagrpid]--;
 	up_write(&nvmet_ana_sem);
 
-	kfree(ns->device_path);
 	kfree(ns);
 }
 
-- 
2.53.0