[4.9,092/139] nvmet: fix uninitialized work for zero kato

Message ID	20201027134906.504701758@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <SRS0=OPSA=EC=vger.kernel.org=stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, zhenwei pi <pizhenwei@bytedance.com>, Christoph Hellwig <hch@lst.de>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 4.9 092/139] nvmet: fix uninitialized work for zero kato Date: Tue, 27 Oct 2020 14:49:46 +0100 Message-Id: <20201027134906.504701758@linuxfoundation.org> In-Reply-To: <20201027134902.130312227@linuxfoundation.org> References: <20201027134902.130312227@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [4.9,002/139] tipc: fix the skb_unshare() in tipc_buf_append() [4.9,003/139] net/ipv4: always honour route mtu during forwarding [4.9,004/139] r8169: fix data corruption issue on RTL8402 [4.9,005/139] ALSA: bebob: potential info leak in hwdep_read() [4.9,006/139] net: hdlc: In hdlc_rcv, check to make sure dev is an HDLC device [4.9,007/139] net: hdlc_raw_eth: Clear the IFF_TX_SKB_SHARING flag after calling ether_setup [4.9,008/139] nfc: Ensure presence of NFC_ATTR_FIRMWARE_NAME attribute in nfc_genl_fw_download() [4.9,009/139] tcp: fix to update snd_wl1 in bulk receiver fast path [4.9,010/139] icmp: randomize the global rate limiter [4.9,011/139] cifs: remove bogus debug code [4.9,012/139] KVM: x86/mmu: Commit zap of remaining invalid pages when recovering lpages [4.9,013/139] ima: Dont ignore errors from crypto_shash_update() [4.9,014/139] crypto: algif_aead - Do not set MAY_BACKLOG on the async path [4.9,015/139] EDAC/i5100: Fix error handling order in i5100_init_one() [4.9,016/139] crypto: ixp4xx - Fix the size used in a dma_free_coherent() call [4.9,017/139] media: Revert "media: exynos4-is: Add missed check for pinctrl_lookup_state()" [4.9,018/139] media: m5mols: Check function pointer in m5mols_sensor_power [4.9,019/139] media: omap3isp: Fix memleak in isp_probe [4.9,020/139] crypto: omap-sham - fix digcnt register handling with export/import [4.9,021/139] media: tc358743: initialize variable [4.9,022/139] media: platform: fcp: Fix a reference count leak. [4.9,023/139] media: ti-vpe: Fix a missing check and reference count leak [4.9,024/139] regulator: resolve supply after creating regulator [4.9,025/139] ath10k: provide survey info as accumulated data [4.9,026/139] ath6kl: prevent potential array overflow in ath6kl_add_new_sta() [4.9,027/139] ath9k: Fix potential out of bounds in ath9k_htc_txcompletion_cb() [4.9,028/139] wcn36xx: Fix reported 802.11n rx_highest rate wcn3660/wcn3680 [4.9,029/139] ASoC: qcom: lpass-platform: fix memory leak [4.9,030/139] mwifiex: Do not use GFP_KERNEL in atomic context [4.9,031/139] drm/gma500: fix error check [4.9,032/139] scsi: qla4xxx: Fix an error handling path in qla4xxx_get_host_stats() [4.9,033/139] scsi: csiostor: Fix wrong return value in csio_hw_prep_fw() [4.9,034/139] backlight: sky81452-backlight: Fix refcount imbalance on error [4.9,035/139] VMCI: check return value of get_user_pages_fast() for errors [4.9,036/139] tty: serial: earlycon dependency [4.9,037/139] tty: hvcs: Dont NULL tty->driver_data until hvcs_cleanup() [4.9,038/139] pty: do tty_flip_buffer_push without port->lock in pty_write [4.9,039/139] drivers/virt/fsl_hypervisor: Fix error handling path [4.9,040/139] video: fbdev: vga16fb: fix setting of pixclock because a pass-by-value error [4.9,041/139] video: fbdev: sis: fix null ptr dereference [4.9,042/139] HID: roccat: add bounds checking in kone_sysfs_write_settings() [4.9,043/139] ath6kl: wmi: prevent a shift wrapping bug in ath6kl_wmi_delete_pstream_cmd() [4.9,044/139] misc: mic: scif: Fix error handling path [4.9,045/139] ALSA: seq: oss: Avoid mutex lock for a long-time ioctl [4.9,046/139] quota: clear padding in v2r1_mem2diskdqb() [4.9,047/139] net: enic: Cure the enic api locking trainwreck [4.9,048/139] mfd: sm501: Fix leaks in probe() [4.9,049/139] iwlwifi: mvm: split a print to avoid a WARNING in ROC [4.9,050/139] usb: gadget: f_ncm: fix ncm_bitrate for SuperSpeed and above. [4.9,051/139] usb: gadget: u_ether: enable qmult on SuperSpeed Plus as well [4.9,052/139] nl80211: fix non-split wiphy information [4.9,053/139] scsi: be2iscsi: Fix a theoretical leak in beiscsi_create_eqs() [4.9,054/139] mwifiex: fix double free [4.9,055/139] net: korina: fix kfree of rx/tx descriptor array [4.9,056/139] IB/mlx4: Fix starvation in paravirt mux/demux [4.9,057/139] IB/mlx4: Adjust delayed work when a dup is observed [4.9,058/139] powerpc/pseries: Fix missing of_node_put() in rng_init() [4.9,059/139] powerpc/icp-hv: Fix missing of_node_put() in success path [4.9,060/139] mtd: lpddr: fix excessive stack usage with clang [4.9,061/139] mtd: mtdoops: Dont write panic data twice [4.9,062/139] ARM: 9007/1: l2c: fix prefetch bits init in L2X0_AUX_CTRL using DT values [4.9,063/139] RDMA/qedr: Fix use of uninitialized field [4.9,064/139] powerpc/tau: Use appropriate temperature sample interval [4.9,065/139] powerpc/tau: Remove duplicated set_thresholds() call [4.9,066/139] powerpc/tau: Disable TAU between measurements [4.9,067/139] perf intel-pt: Fix "context_switch event has no tid" error [4.9,068/139] RDMA/hns: Set the unsupported wr opcode [4.9,069/139] kdb: Fix pager search for multi-line strings [4.9,070/139] overflow: Include header file with SIZE_MAX declaration [4.9,071/139] powerpc/perf: Exclude pmc5/6 from the irrelevant PMU group constraints [4.9,072/139] powerpc/perf/hv-gpci: Fix starting index value [4.9,073/139] cpufreq: powernv: Fix frame-size-overflow in powernv_cpufreq_reboot_notifier [4.9,074/139] IB/rdmavt: Fix sizeof mismatch [4.9,075/139] lib/crc32.c: fix trivial typo in preprocessor condition [4.9,076/139] rapidio: fix error handling path [4.9,077/139] rapidio: fix the missed put_device() for rio_mport_add_riodev [4.9,078/139] clk: at91: clk-main: update key before writing AT91_CKGR_MOR [4.9,079/139] clk: bcm2835: add missing release if devm_clk_hw_register fails [4.9,080/139] vfio/pci: Clear token on bypass registration failure [4.9,081/139] Input: imx6ul_tsc - clean up some errors in imx6ul_tsc_resume() [4.9,082/139] Input: ep93xx_keypad - fix handling of platform_get_irq() error [4.9,083/139] Input: omap4-keypad - fix handling of platform_get_irq() error [4.9,084/139] Input: twl4030_keypad - fix handling of platform_get_irq() error [4.9,085/139] Input: sun4i-ps2 - fix handling of platform_get_irq() error [4.9,086/139] KVM: x86: emulating RDPID failure shall return #UD rather than #GP [4.9,087/139] memory: omap-gpmc: Fix a couple off by ones [4.9,088/139] memory: fsl-corenet-cf: Fix handling of platform_get_irq() error [4.9,089/139] arm64: dts: qcom: msm8916: Fix MDP/DSI interrupts [4.9,090/139] arm64: dts: zynqmp: Remove additional compatible string for i2c IPs [4.9,091/139] powerpc/powernv/dump: Fix race while processing OPAL dump [4.9,092/139] nvmet: fix uninitialized work for zero kato [4.9,093/139] NTB: hw: amd: fix an issue about leak system resources [4.9,094/139] crypto: ccp - fix error handling [4.9,095/139] media: firewire: fix memory leak [4.9,096/139] media: ati_remote: sanity check for both endpoints [4.9,097/139] media: exynos4-is: Fix several reference count leaks due to pm_runtime_get_sync [4.9,098/139] media: exynos4-is: Fix a reference count leak due to pm_runtime_get_sync [4.9,099/139] media: exynos4-is: Fix a reference count leak [4.9,100/139] media: vsp1: Fix runtime PM imbalance on error [4.9,101/139] media: platform: s3c-camif: Fix runtime PM imbalance on error [4.9,102/139] media: platform: sti: hva: Fix runtime PM imbalance on error [4.9,103/139] media: bdisp: Fix runtime PM imbalance on error [4.9,104/139] media: media/pci: prevent memory leak in bttv_probe [4.9,105/139] media: uvcvideo: Ensure all probed info is returned to v4l2 [4.9,106/139] mmc: sdio: Check for CISTPL_VERS_1 buffer size [4.9,107/139] media: saa7134: avoid a shift overflow [4.9,108/139] fs: dlm: fix configfs memory leak [4.9,109/139] ntfs: add check for mft record size in superblock [4.9,110/139] PM: hibernate: remove the bogus call to get_gendisk() in software_resume() [4.9,111/139] scsi: mvumi: Fix error return in mvumi_io_attach() [4.9,112/139] scsi: target: core: Add CONTROL field for trace events [4.9,113/139] mic: vop: copy data to kernel space then write to io memory [4.9,114/139] misc: vop: add round_up(x,4) for vring_size to avoid kernel panic [4.9,115/139] usb: gadget: function: printer: fix use-after-free in __lock_acquire [4.9,116/139] udf: Limit sparing table size [4.9,117/139] udf: Avoid accessing uninitialized data on failed inode read [4.9,118/139] USB: cdc-acm: handle broken union descriptors [4.9,119/139] ath9k: hif_usb: fix race condition between usb_get_urb() and usb_kill_anchored_urbs() [4.9,120/139] misc: rtsx: Fix memory leak in rtsx_pci_probe [4.9,121/139] reiserfs: only call unlock_new_inode() if I_NEW [4.9,122/139] xfs: make sure the rt allocator doesnt run off the end [4.9,123/139] usb: ohci: Default to per-port over-current protection [4.9,124/139] Bluetooth: Only mark socket zapped after unlocking [4.9,125/139] scsi: ibmvfc: Fix error return in ibmvfc_probe() [4.9,126/139] brcmsmac: fix memory leak in wlc_phy_attach_lcnphy [4.9,127/139] rtl8xxxu: prevent potential memory leak [4.9,128/139] Fix use after free in get_capset_info callback. [4.9,129/139] tty: ipwireless: fix error handling [4.9,130/139] ipvs: Fix uninit-value in do_ip_vs_set_ctl() [4.9,131/139] reiserfs: Fix memory leak in reiserfs_parse_options() [4.9,132/139] brcm80211: fix possible memleak in brcmf_proto_msgbuf_attach [4.9,133/139] usb: core: Solve race condition in anchor cleanup functions [4.9,134/139] ath10k: check idx validity in __ath10k_htt_rx_ring_fill_n() [4.9,135/139] net: korina: cast KSEG0 address to pointer in kfree [4.9,136/139] usb: cdc-acm: add quirk to blacklist ETAS ES58X devices [4.9,137/139] USB: cdc-wdm: Make wdm_flush() interruptible and add wdm_fsync(). [4.9,138/139] eeprom: at25: set minimum read/write access stride to 1 [4.9,139/139] usb: gadget: f_ncm: allow using NCM in SuperSpeed Plus gadgets.

Message ID

20201027134906.504701758@linuxfoundation.org

State

Superseded

Headers

From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, zhenwei pi <pizhenwei@bytedance.com>,
	Christoph Hellwig <hch@lst.de>, Sasha Levin <sashal@kernel.org>
Subject: [PATCH 4.9 092/139] nvmet: fix uninitialized work for zero kato
Date: Tue, 27 Oct 2020 14:49:46 +0100
Message-Id: <20201027134906.504701758@linuxfoundation.org>
In-Reply-To: <20201027134902.130312227@linuxfoundation.org>
References: <20201027134902.130312227@linuxfoundation.org>
User-Agent: quilt/0.66
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Precedence: bulk

Series

None | expand

Commit Message

Greg KH Oct. 27, 2020, 1:49 p.m. UTC

From: zhenwei pi <pizhenwei@bytedance.com>

[ Upstream commit 85bd23f3dc09a2ae9e56885420e52c54bf983713 ]

When connecting a controller with a zero kato value using the following
command line

   nvme connect -t tcp -n NQN -a ADDR -s PORT --keep-alive-tmo=0

the warning below can be reproduced:

WARNING: CPU: 1 PID: 241 at kernel/workqueue.c:1627 __queue_delayed_work+0x6d/0x90
with trace:
  mod_delayed_work_on+0x59/0x90
  nvmet_update_cc+0xee/0x100 [nvmet]
  nvmet_execute_prop_set+0x72/0x80 [nvmet]
  nvmet_tcp_try_recv_pdu+0x2f7/0x770 [nvmet_tcp]
  nvmet_tcp_io_work+0x63f/0xb2d [nvmet_tcp]
  ...

This is caused by queuing up an uninitialized work.  Althrough the
keep-alive timer is disabled during allocating the controller (fixed in
0d3b6a8d213a), ka_work still has a chance to run (called by
nvmet_start_ctrl).

Fixes: 0d3b6a8d213a ("nvmet: Disable keep-alive timer when kato is cleared to 0h")
Signed-off-by: zhenwei pi <pizhenwei@bytedance.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/target/core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
index 63b87a8472762..4b58f352c0c93 100644
--- a/drivers/nvme/target/core.c
+++ b/drivers/nvme/target/core.c
@@ -591,7 +591,8 @@  static void nvmet_start_ctrl(struct nvmet_ctrl *ctrl)
 	 * in case a host died before it enabled the controller.  Hence, simply
 	 * reset the keep alive timer when the controller is enabled.
 	 */
-	mod_delayed_work(system_wq, &ctrl->ka_work, ctrl->kato * HZ);
+	if (ctrl->kato)
+		mod_delayed_work(system_wq, &ctrl->ka_work, ctrl->kato * HZ);
 }
 
 static void nvmet_clear_ctrl(struct nvmet_ctrl *ctrl)

[4.9,092/139] nvmet: fix uninitialized work for zero kato

Commit Message

Patch