Commit b0100517 authored by Jacek Kalwas's avatar Jacek Kalwas Committed by Tomasz Zawadzki
Browse files

bdev/nvme: fix ref get in populate namepsace flow 



Consider the case when there is only one reference (NVMe ctrlr
creation), and a populate namespace operation is outstanding
(delayed for whatever reason). If spdk_bdev_nvme_delete is invoked
before it completes, _nvme_ctrlr_destruct can then put the last
reference.

To fix this, the reference should be acquired before the async operation
and not after.

Found by code inspection.

Change-Id: Ia7c0fe5d7f4e63df58054d93956c4647d7f6fd21
Signed-off-by: default avatarJacek Kalwas <jacek.kalwas@nutanix.com>
Reviewed-on: https://review.spdk.io/c/spdk/spdk/+/26753


Reviewed-by: default avatarAleksey Marchuk <alexeymar@nvidia.com>
Reviewed-by: default avatarJim Harris <jim.harris@nvidia.com>
Reviewed-by: default avatarShuhei Matsumoto <smatsumoto@nvidia.com>
Community-CI: Mellanox Build Bot
Tested-by: default avatarSPDK Automated Test System <spdkbot@gmail.com>
parent 0219a750

module/bdev/nvme/bdev_nvme.c

+3 −2
Original line number Diff line number Diff line
@@ -4970,13 +4970,12 @@ nvme_ctrlr_populate_namespace_done(struct nvme_ns *nvme_ns, int rc) 


	if (rc == 0) {

		nvme_ns->probe_ctx = NULL;

		nvme_ctrlr_get_ref(nvme_ctrlr);

	} else {

		pthread_mutex_lock(&nvme_ctrlr->mutex);

		RB_REMOVE(nvme_ns_tree, &nvme_ctrlr->namespaces, nvme_ns);

		pthread_mutex_unlock(&nvme_ctrlr->mutex);



		nvme_ns_free(nvme_ns);

		nvme_ctrlr_put_ref(nvme_ctrlr);

	}



	if (ctx) {
@@ -5088,6 +5087,8 @@ nvme_ctrlr_populate_namespace(struct nvme_ctrlr *nvme_ctrlr, struct nvme_ns *nvm 
	struct nvme_bdev	*bdev;

	int			rc = 0;



	nvme_ctrlr_get_ref(nvme_ctrlr);



	ns = spdk_nvme_ctrlr_get_ns(nvme_ctrlr->ctrlr, nvme_ns->id);

	if (!ns) {

		NVME_NS_DEBUGLOG(nvme_ns, "Invalid NS\n");