Blob Blame History Raw
From: Bart Van Assche <bvanassche@acm.org>
Date: Fri, 1 Nov 2019 13:47:56 -0700
Subject: Revert "RDMA/srpt: Postpone HCA removal until after configfs
 directory removal"
Patch-mainline: v5.5-rc1
Git-commit: 77cf98d4ec90e8c48592c6537cfc2281c58f7ac3
References: jsc#SLE-8449

Although the mentioned patch fixes a use-after-free bug, it introduces a
hang during shutdown. Since the latter is worse, revert this patch.

Link: https://lore.kernel.org/r/20191101204756.182162-1-bvanassche@acm.org
Reported-by: Honggang Li <honli@redhat.com>
Fixes: 9b64f7d0bb0a ("RDMA/srpt: Postpone HCA removal until after configfs directory removal")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Acked-by: Honggang Li <honli@redhat.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
---
 drivers/infiniband/ulp/srpt/ib_srpt.c |    6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
+++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
@@ -2936,7 +2936,7 @@ static int srpt_release_sport(struct srp
 
 	while (atomic_read(&sport->refcount) > 0 &&
 	       wait_for_completion_timeout(&c, 5 * HZ) <= 0) {
-		pr_info("%s_%d: waiting for unregistration of %d sessions and configfs directories ...\n",
+		pr_info("%s_%d: waiting for unregistration of %d sessions ...\n",
 			dev_name(&sport->sdev->device->dev), sport->port,
 			atomic_read(&sport->refcount));
 		rcu_read_lock();
@@ -3733,7 +3733,6 @@ static struct configfs_attribute *srpt_t
 static struct se_portal_group *srpt_make_tpg(struct se_wwn *wwn,
 					     const char *name)
 {
-	struct srpt_port *sport = wwn->priv;
 	struct srpt_port_id *sport_id = srpt_wwn_to_sport_id(wwn);
 	struct srpt_tpg *stpg;
 	int res = -ENOMEM;
@@ -3752,8 +3751,6 @@ static struct se_portal_group *srpt_make
 	list_add_tail(&stpg->entry, &sport_id->tpg_list);
 	mutex_unlock(&sport_id->mutex);
 
-	atomic_inc(&sport->refcount);
-
 	return &stpg->tpg;
 }
 
@@ -3774,7 +3771,6 @@ static void srpt_drop_tpg(struct se_port
 	sport->enabled = false;
 	core_tpg_deregister(tpg);
 	kfree(stpg);
-	srpt_drop_sport_ref(sport);
 }
 
 /**