nvmet: cache passthru reference in __nvmet_req_complete()

__nvmet_req_complete() releases the passthru reference held while
processing a passthru request. However, it currently does so after
calling ops->queue_response().

Once ops->queue_response() is called, the transport may complete and
recycle the request on another CPU. If the request is reused, its
req->p.ref_held field may be reset to false before
__nvmet_req_complete() checks it in nvmet_put_passthru_ref().
Consequently, the passthru reference may not be released, leaving
wait_for_completion(&passthru->disable_done) in
__nvmet_passthru_ctrl_disable() blocked indefinitely.

Fix this by caching the passthru pointer at the beginning of
__nvmet_req_complete(), while the request is still valid, and use
the cached pointer to release the reference after queuing the
response. This also changes nvmet_put_passthru_ref() to accept
the passthru pointer directly instead of accessing it through
the request.

Reported-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
Closes: https://lore.kernel.org/all/auhpmq499RVE9YpC@shinmob/
Fixes: 5e12d81874a1 ("nvmet: fix use-after-free in passthru I/O hotpath")
Tested-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
Signed-off-by: Nilay Shroff <nilay@linux.ibm.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>

0 files changed, 0 insertions, 0 deletions