Commit 999f0362 authored by Shuhei Matsumoto's avatar Shuhei Matsumoto Committed by Tomasz Zawadzki
Browse files

nvme_tcp: Remove qpair from group->needs_poll when removing it from poll_group 



spdk_sock_close() may not complete synchronously.

Then the following scenario is possible.

ctrlr_disconnected_qpair() calls spdk_sock_close(). Then any request may
complete and call _pdu_write_done(). qpair is still associated with a
poll_group and is inserted into the group->needs_poll list.
After ctrlr_disconnected_qpair() completes, disconnected_qpair_cb() is
called. disconnected_qpair_cb() calls spdk_nvme_ctrlr_free_io_qpair().
spdk_nvme_ctrlr_free_io_qpair() calls spdk_nvme_poll_group_remove().

spdk_nvme_poll_group() removes qpair only from the
group->disconnected_qpairs list.

Even after qpair->poll_group is nullified, qpair is still in the
group->needs_poll list.

Then spdk_nvme_poll_group_process_completions() polls all qpairs in
the group->needs_poll list and hits the assert.

Fixes the issue #2390

Signed-off-by: default avatarShuhei Matsumoto <smatsumoto@nvidia.com>
Change-Id: I6ede8bd3b7b1a57a34ac61436159975ab6253fbe
Reviewed-on: https://review.spdk.io/gerrit/c/spdk/spdk/+/11882


Community-CI: Broadcom CI <spdk-ci.pdl@broadcom.com>
Community-CI: Mellanox Build Bot
Tested-by: default avatarSPDK CI Jenkins <sys_sgci@intel.com>
Reviewed-by: default avatarAleksey Marchuk <alexeymar@mellanox.com>
Reviewed-by: default avatarKonrad Sztyber <konrad.sztyber@intel.com>
parent 22e8fc83

lib/nvme/nvme_tcp.c

+7 −0
Original line number Diff line number Diff line
@@ -2294,14 +2294,21 @@ nvme_tcp_poll_group_remove(struct spdk_nvme_transport_poll_group *tgroup, 
			   struct spdk_nvme_qpair *qpair)

{

	struct nvme_tcp_qpair *tqpair;

	struct nvme_tcp_poll_group *group;



	assert(qpair->poll_group_tailq_head == &tgroup->disconnected_qpairs);



	tqpair = nvme_tcp_qpair(qpair);

	group = nvme_tcp_poll_group(tgroup);



	assert(tqpair->shared_stats == true);

	tqpair->stats = &g_dummy_stats;



	if (tqpair->needs_poll) {

		TAILQ_REMOVE(&group->needs_poll, tqpair, link);

		tqpair->needs_poll = false;

	}



	return 0;

}