From: Christoph Hellwig <h...@lst.de>

[ Upstream commit 5fb4aac756acacf260b9ebd88747251effa3a2f2 ]

Holding the SRCU critical section protecting the namespace list can
cause deadlocks when using the per-namespace admin passthrough ioctl to
delete as namespace.  Release it earlier when performing per-controller
ioctls to avoid that.

Reported-by: Kenneth Heitke <kenneth.hei...@intel.com>
Reviewed-by: Chaitanya Kulkarni <chaitanya.kulka...@wdc.com>
Reviewed-by: Keith Busch <keith.bu...@intel.com>
Signed-off-by: Christoph Hellwig <h...@lst.de>
Signed-off-by: Sasha Levin <sas...@kernel.org>
---
 drivers/nvme/host/core.c | 25 ++++++++++++++++++++-----
 1 file changed, 20 insertions(+), 5 deletions(-)

diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 82f5f1d030d4..818788275406 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -1310,14 +1310,31 @@ static int nvme_ioctl(struct block_device *bdev, 
fmode_t mode,
        if (unlikely(!ns))
                return -EWOULDBLOCK;
 
+       /*
+        * Handle ioctls that apply to the controller instead of the namespace
+        * seperately and drop the ns SRCU reference early.  This avoids a
+        * deadlock when deleting namespaces using the passthrough interface.
+        */
+       if (cmd == NVME_IOCTL_ADMIN_CMD || is_sed_ioctl(cmd)) {
+               struct nvme_ctrl *ctrl = ns->ctrl;
+
+               nvme_get_ctrl(ns->ctrl);
+               nvme_put_ns_from_disk(head, srcu_idx);
+
+               if (cmd == NVME_IOCTL_ADMIN_CMD)
+                       ret = nvme_user_cmd(ctrl, NULL, argp);
+               else
+                       ret = sed_ioctl(ctrl->opal_dev, cmd, argp);
+
+               nvme_put_ctrl(ctrl);
+               return ret;
+       }
+
        switch (cmd) {
        case NVME_IOCTL_ID:
                force_successful_syscall_return();
                ret = ns->head->ns_id;
                break;
-       case NVME_IOCTL_ADMIN_CMD:
-               ret = nvme_user_cmd(ns->ctrl, NULL, argp);
-               break;
        case NVME_IOCTL_IO_CMD:
                ret = nvme_user_cmd(ns->ctrl, ns, argp);
                break;
@@ -1327,8 +1344,6 @@ static int nvme_ioctl(struct block_device *bdev, fmode_t 
mode,
        default:
                if (ns->ndev)
                        ret = nvme_nvm_ioctl(ns, cmd, arg);
-               else if (is_sed_ioctl(cmd))
-                       ret = sed_ioctl(ns->ctrl->opal_dev, cmd, argp);
                else
                        ret = -ENOTTY;
        }
-- 
2.20.1

Reply via email to