[PATCH v4] nvme: rdma/tcp: fix list corruption with anatt timer

[Christoph Hellwig]

On Thu, Apr 29, 2021 at 02:24:33PM +0200, Christoph Hellwig wrote:
> Martin,
> 
> can you give this patch a spin and check if this solves your issue?

ping?

> 
> diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
> index 0d0de3433f37..68f4d9d0ce58 100644
> --- a/drivers/nvme/host/multipath.c
> +++ b/drivers/nvme/host/multipath.c
> @@ -780,6 +780,8 @@ void nvme_mpath_remove_disk(struct nvme_ns_head *head)
>  
>  int nvme_mpath_init(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id)
>  {
> +	size_t max_transfer_size = ctrl->max_hw_sectors << SECTOR_SHIFT;
> +	size_t ana_log_size;
>  	int error;
>  
>  	/* check if multipath is enabled and we have the capability */
> @@ -787,47 +789,45 @@ int nvme_mpath_init(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id)
>  	    !(ctrl->subsys->cmic & NVME_CTRL_CMIC_ANA))
>  		return 0;
>  
> +	if (!ctrl->identified) {
> +		mutex_init(&ctrl->ana_lock);
> +		timer_setup(&ctrl->anatt_timer, nvme_anatt_timeout, 0);
> +		INIT_WORK(&ctrl->ana_work, nvme_ana_work);
> +	}
> +
>  	ctrl->anacap = id->anacap;
>  	ctrl->anatt = id->anatt;
>  	ctrl->nanagrpid = le32_to_cpu(id->nanagrpid);
>  	ctrl->anagrpmax = le32_to_cpu(id->anagrpmax);
>  
> -	mutex_init(&ctrl->ana_lock);
> -	timer_setup(&ctrl->anatt_timer, nvme_anatt_timeout, 0);
> -	ctrl->ana_log_size = sizeof(struct nvme_ana_rsp_hdr) +
> -		ctrl->nanagrpid * sizeof(struct nvme_ana_group_desc);
> -	ctrl->ana_log_size += ctrl->max_namespaces * sizeof(__le32);
> -
> -	if (ctrl->ana_log_size > ctrl->max_hw_sectors << SECTOR_SHIFT) {
> +	ana_log_size = sizeof(struct nvme_ana_rsp_hdr) +
> +		ctrl->nanagrpid * sizeof(struct nvme_ana_group_desc) +
> +		ctrl->max_namespaces * sizeof(__le32);
> +	if (ana_log_size > max_transfer_size) {
>  		dev_err(ctrl->device,
> -			"ANA log page size (%zd) larger than MDTS (%d).\n",
> -			ctrl->ana_log_size,
> -			ctrl->max_hw_sectors << SECTOR_SHIFT);
> +			"ANA log page size (%zd) larger than MDTS (%zd).\n",
> +			ana_log_size, max_transfer_size);
>  		dev_err(ctrl->device, "disabling ANA support.\n");
>  		return 0;
>  	}
>  
> -	INIT_WORK(&ctrl->ana_work, nvme_ana_work);
> -	kfree(ctrl->ana_log_buf);
> -	ctrl->ana_log_buf = kmalloc(ctrl->ana_log_size, GFP_KERNEL);
> -	if (!ctrl->ana_log_buf) {
> -		error = -ENOMEM;
> -		goto out;
> +	if (ana_log_size > ctrl->ana_log_size) {
> +		nvme_mpath_uninit(ctrl);
> +		ctrl->ana_log_buf = kmalloc(ctrl->ana_log_size, GFP_KERNEL);
> +		if (!ctrl->ana_log_buf)
> +			return -ENOMEM;
> +		ctrl->ana_log_size = ana_log_size;
>  	}
>  
>  	error = nvme_read_ana_log(ctrl);
>  	if (error)
> -		goto out_free_ana_log_buf;
> -	return 0;
> -out_free_ana_log_buf:
> -	kfree(ctrl->ana_log_buf);
> -	ctrl->ana_log_buf = NULL;
> -out:
> +		nvme_mpath_uninit(ctrl);
>  	return error;
>  }
>  
>  void nvme_mpath_uninit(struct nvme_ctrl *ctrl)
>  {
> +	nvme_mpath_stop(ctrl);
>  	kfree(ctrl->ana_log_buf);
>  	ctrl->ana_log_buf = NULL;
>  }
---end quoted text---