Patch "nvme_fcloop: fix abort race condition" has been added to the 4.14-stable tree

This is a note to let you know that I've just added the patch titled

nvme_fcloop: fix abort race condition

to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
nvme_fcloop-fix-abort-race-condition.patch
and it can be found in the queue-4.14 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: James Smart <[email protected]>
Date: Wed, 29 Nov 2017 16:47:30 -0800
Subject: nvme_fcloop: fix abort race condition

From: James Smart <[email protected]>

[ Upstream commit 278e096063f1914fccfc77a617be9fc8dbb31b0e ]

A test case revealed a race condition of an i/o completing on a thread parallel to the delete_association generating the aborts for the outstanding ios on the controller. The i/o completion was freeing the target fcloop context, thus the abort task referenced the just-freed memory.

Correct by clearing the target/initiator cross pointers in the io completion and abort tasks before calling the callbacks. On aborts that detect already finished io's, ensure the complete context is called.

---
 drivers/nvme/target/fcloop.c |   12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

@@ -374,6 +374,7 @@ fcloop_tgt_fcprqst_done_work(struct work
 
 	spin_lock(&tfcp_req->reqlock);
 	fcpreq = tfcp_req->fcpreq;
+	tfcp_req->fcpreq = NULL;
 	spin_unlock(&tfcp_req->reqlock);
 
 	if (tport->remoteport && fcpreq) {

@@ -615,11 +616,7 @@ fcloop_fcp_abort(struct nvme_fc_local_po
 
 	if (!tfcp_req)
 		/* abort has already been called */
-		return;
-
-	if (rport->targetport)
-		nvmet_fc_rcv_fcp_abort(rport->targetport,
-					&tfcp_req->tgt_fcp_req);
+		goto finish;
 
 	/* break initiator/target relationship for io */
 	spin_lock(&tfcp_req->reqlock);

@@ -627,6 +624,11 @@ fcloop_fcp_abort(struct nvme_fc_local_po
 	tfcp_req->fcpreq = NULL;
 	spin_unlock(&tfcp_req->reqlock);
 
+	if (rport->targetport)
+		nvmet_fc_rcv_fcp_abort(rport->targetport,
+					&tfcp_req->tgt_fcp_req);
+
+finish:
 	/* post the aborted io completion */
 	fcpreq->status = -ECANCELED;
 	schedule_work(&inireq->iniwork);

Patches currently in stable-queue which might be from [email protected] are

queue-4.14/nvme_fcloop-fix-abort-race-condition.patch queue-4.14/nvme_fcloop-disassocate-local-port-structs.patch