IB/srp: Keep rport as long as the IB transport layer

Keep the rport data structure around after srp_remove_host() has
finished until cleanup of the IB transport layer has finished
completely. This is necessary because later patches use the rport
pointer inside the queuecommand callback. Without this patch
accessing the rport from inside a queuecommand callback is racy
because srp_remove_host() must be invoked before scsi_remove_host()
and because the queuecommand callback could get invoked after
srp_remove_host() has finished. In other words, without this patch
the queuecommand callback can get invoked after the rport data
structure has been freed.

Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Acked-by: David Dillow <dillowda@ornl.gov>
Signed-off-by: Roland Dreier <roland@purestorage.com>

diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index 11ebf3e7646a6bd6b808edfb8286289ad0f3db67..6edab7855f5e37f757324079ed980153e1db81ce 100644 (file)
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -528,11 +528,13 @@ static void srp_remove_target(struct srp_target_port *target)
        WARN_ON_ONCE(target->state != SRP_TARGET_REMOVED);
 
        srp_del_scsi_host_attr(target->scsi_host);
+       srp_rport_get(target->rport);
        srp_remove_host(target->scsi_host);
        scsi_remove_host(target->scsi_host);
        srp_disconnect_target(target);
        ib_destroy_cm_id(target->cm_id);
        srp_free_target_ib(target);
+       srp_rport_put(target->rport);
        srp_free_req_data(target);
        scsi_host_put(target->scsi_host);
 }
@@ -2004,6 +2006,7 @@ static int srp_add_target(struct srp_host *host, struct srp_target_port *target)
        }
 
        rport->lld_data = target;
+       target->rport = rport;
 
        spin_lock(&host->target_lock);
        list_add_tail(&target->list, &host->target_list);

diff --git a/drivers/infiniband/ulp/srp/ib_srp.h b/drivers/infiniband/ulp/srp/ib_srp.h
index 84d821b24ec72cdb240261b9a98e897d51bbbd4a..2a1768fcc57d7bc80fd1829246abaf129220ae25 100644 (file)
--- a/drivers/infiniband/ulp/srp/ib_srp.h
+++ b/drivers/infiniband/ulp/srp/ib_srp.h
@@ -153,6 +153,7 @@ struct srp_target_port {
        u16                     io_class;
        struct srp_host        *srp_host;
        struct Scsi_Host       *scsi_host;
+       struct srp_rport       *rport;
        char                    target_name[32];
        unsigned int            scsi_id;
        unsigned int            sg_tablesize;

diff --git a/drivers/scsi/scsi_transport_srp.c b/drivers/scsi/scsi_transport_srp.c
index f379c7f3034cd55392355189e081b45547323008..f7ba94aa52cbf1fad0454b11c98e2d545d42f50b 100644 (file)
--- a/drivers/scsi/scsi_transport_srp.c
+++ b/drivers/scsi/scsi_transport_srp.c
@@ -184,6 +184,24 @@ static int srp_host_match(struct attribute_container *cont, struct device *dev)
        return &i->t.host_attrs.ac == cont;
 }
 
+/**
+ * srp_rport_get() - increment rport reference count
+ */
+void srp_rport_get(struct srp_rport *rport)
+{
+       get_device(&rport->dev);
+}
+EXPORT_SYMBOL(srp_rport_get);
+
+/**
+ * srp_rport_put() - decrement rport reference count
+ */
+void srp_rport_put(struct srp_rport *rport)
+{
+       put_device(&rport->dev);
+}
+EXPORT_SYMBOL(srp_rport_put);
+
 /**
  * srp_rport_add - add a SRP remote port to the device hierarchy
  * @shost:     scsi host the remote port is connected to.

diff --git a/include/scsi/scsi_transport_srp.h b/include/scsi/scsi_transport_srp.h
index ff0f04ac91aad7c2311f9b889aa09c0accb90cc6..5a2d2d1081c1674b56d5f9f81e20bb760a93bb28 100644 (file)
--- a/include/scsi/scsi_transport_srp.h
+++ b/include/scsi/scsi_transport_srp.h
@@ -38,6 +38,8 @@ extern struct scsi_transport_template *
 srp_attach_transport(struct srp_function_template *);
 extern void srp_release_transport(struct scsi_transport_template *);
 
+extern void srp_rport_get(struct srp_rport *rport);
+extern void srp_rport_put(struct srp_rport *rport);
 extern struct srp_rport *srp_rport_add(struct Scsi_Host *,
                                       struct srp_rport_identifiers *);
 extern void srp_rport_del(struct srp_rport *);