On Fri, Nov 01, 2019 at 01:47:56PM -0700, Bart Van Assche wrote:
> Although the mentioned patch fixes a use-after-free bug, it introduces a
> hang during shutdown. Since the latter is worse, revert this patch.
>
> Cc: Honggang Li <honli@xxxxxxxxxx>
> Cc: Laurence Oberman <loberman@xxxxxxxxxx>
> Reported-by: Honggang Li <honli@xxxxxxxxxx>
> Fixes: 9b64f7d0bb0a ("RDMA/srpt: Postpone HCA removal until after configfs directory removal")
> Signed-off-by: Bart Van Assche <bvanassche@xxxxxxx>
> ---
> drivers/infiniband/ulp/srpt/ib_srpt.c | 5 +----
> 1 file changed, 1 insertion(+), 4 deletions(-)
>
> diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
> index c9972b686c27..53dec7d9829c 100644
> --- a/drivers/infiniband/ulp/srpt/ib_srpt.c
> +++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
> @@ -2960,7 +2960,7 @@ static int srpt_release_sport(struct srpt_port *sport)
>
> while (atomic_read(&sport->refcount) > 0 &&
> wait_for_completion_timeout(&c, 5 * HZ) <= 0) {
> - pr_info("%s_%d: waiting for unregistration of %d sessions and configfs directories ...\n",
> + pr_info("%s_%d: waiting for unregistration of %d sessions ...\n",
> dev_name(&sport->sdev->device->dev), sport->port,
> atomic_read(&sport->refcount));
> rcu_read_lock();
> @@ -3776,8 +3776,6 @@ static struct se_portal_group *srpt_make_tpg(struct se_wwn *wwn,
> list_add_tail(&stpg->entry, &sport_id->tpg_list);
> mutex_unlock(&sport_id->mutex);
>
> - atomic_inc(&sport->refcount);
> -
> return &stpg->tpg;
> }
>
> @@ -3798,7 +3796,6 @@ static void srpt_drop_tpg(struct se_portal_group *tpg)
> sport->enabled = false;
> core_tpg_deregister(tpg);
> kfree(stpg);
> - srpt_drop_sport_ref(sport);
> }
>
Acked-by: Honggang Li <honli@xxxxxxxxxx>
> /**
> --
> 2.24.0.rc1.363.gb1bccd3e3d-goog
>
