Return-Path: From: Sasha Levin To: stable@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Keith Busch , Christoph Hellwig , Sasha Levin Subject: [PATCH AUTOSEL 4.18 03/33] nvme: remove ns sibling before clearing path Date: Tue, 30 Oct 2018 09:26:27 -0400 Message-Id: <20181030132657.217970-3-sashal@kernel.org> In-Reply-To: <20181030132657.217970-1-sashal@kernel.org> References: <20181030132657.217970-1-sashal@kernel.org> List-ID: From: Keith Busch [ Upstream commit 48f78be3326052a7718678ff9a78d6d884a50323 ] The code had been clearing a namespace being deleted as the current path while that namespace was still in the path siblings list. It is possible a new IO could set that namespace back to the current path since it appeared to be an eligable path to select, which may result in a use-after-free error. This patch ensures a namespace being removed is not eligable to be reset as a current path prior to clearing it as the current path. Signed-off-by: Keith Busch Reviewed-by: Sagi Grimberg Signed-off-by: Christoph Hellwig Signed-off-by: Sasha Levin --- drivers/nvme/host/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c index bf65501e6ed6..f1f375fb362b 100644 --- a/drivers/nvme/host/core.c +++ b/drivers/nvme/host/core.c @@ -3119,8 +3119,8 @@ static void nvme_ns_remove(struct nvme_ns *ns) } mutex_lock(&ns->ctrl->subsys->lock); - nvme_mpath_clear_current_path(ns); list_del_rcu(&ns->siblings); + nvme_mpath_clear_current_path(ns); mutex_unlock(&ns->ctrl->subsys->lock); down_write(&ns->ctrl->namespaces_rwsem); -- 2.17.1