[PATCH] nvme-tcp: wait for in-flight TLS handshake callback

[Avi Weiss]

When nvme_tcp_start_tls() times out or is interrupted,
tls_handshake_cancel() can return false after handshake_complete()
marks the request completed, but before nvme_tcp_tls_done()
finishes. Error cleanup can then release the queue while the
callback still accesses it.

Wait for queue->tls_complete when cancellation loses, before
continuing cleanup. Preserve the original timeout or signal error.

This follows the cancellation/completion synchronization used
in SunRPC for:
- commit d00e32f84ca1 ("sunrpc: wait for in-flight TLS handshake
  callback when cancel loses race")
- commit a89dd5974588 ("SUNRPC: wait for in-flight client TLS
  handshake callback")

Fixes: be8e82caa685 ("nvme-tcp: enable TLS handshake upcall")
Signed-off-by: Avi Weiss <thnkslprpt at gmail.com>
---
 drivers/nvme/host/tcp.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
index 7eec983c0ead..26a626abef7b 100644
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -1816,7 +1816,8 @@ static int nvme_tcp_start_tls(struct nvme_ctrl *nctrl,
 		dev_err(nctrl->device,
 			"queue %d: TLS handshake failed, error %d\n",
 			qid, ret);
-		tls_handshake_cancel(queue->sock->sk);
+		if (!tls_handshake_cancel(queue->sock->sk))
+			wait_for_completion(&queue->tls_complete);
 	} else {
 		if (queue->tls_err) {
 			dev_err(nctrl->device,

base-commit: 7be4bc52fd9e0e55dc9a2e0232b89427d2c4b614
-- 
2.43.0