nvme-rdma: cancel async events before freeing event struct

David Milburn · Christoph Hellwig · commit 925dd04c1f98 · 2020-09-08T19:46:29.000+02:00
Cancel async event work in case async event has been queued up, and
nvme_rdma_submit_async_event() runs after event has been freed.

Signed-off-by: David Milburn &lt;dmilburn@redhat.com&gt;
Reviewed-by: Keith Busch &lt;kbusch@kernel.org&gt;
Reviewed-by: Sagi Grimberg &lt;sagi@grimberg.me&gt;
Signed-off-by: Christoph Hellwig &lt;hch@lst.de&gt;
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
@@ -835,6 +835,7 @@ static void nvme_rdma_destroy_admin_queue(struct nvme_rdma_ctrl *ctrl,
 		blk_mq_free_tag_set(ctrl->ctrl.admin_tagset);
 	}
 	if (ctrl->async_event_sqe.data) {
+		cancel_work_sync(&ctrl->ctrl.async_event_work);
 		nvme_rdma_free_qe(ctrl->device->dev, &ctrl->async_event_sqe,
 				sizeof(struct nvme_command), DMA_TO_DEVICE);
 		ctrl->async_event_sqe.data = NULL;

Original file line number	Diff line number	Diff line change
`@@ -835,6 +835,7 @@ static void nvme_rdma_destroy_admin_queue(struct nvme_rdma_ctrl *ctrl,`
`835`	`835`	`blk_mq_free_tag_set(ctrl->ctrl.admin_tagset);`
`836`	`836`	`}`
`837`	`837`	`if (ctrl->async_event_sqe.data) {`
	`838`	`+ cancel_work_sync(&ctrl->ctrl.async_event_work);`
`838`	`839`	`nvme_rdma_free_qe(ctrl->device->dev, &ctrl->async_event_sqe,`
`839`	`840`	`sizeof(struct nvme_command), DMA_TO_DEVICE);`
`840`	`841`	`ctrl->async_event_sqe.data = NULL;`