Patch "nvme: do not let the user delete a ctrl before a complete initialization" has been added to the 6.1-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    nvme: do not let the user delete a ctrl before a complete initialization

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     nvme-do-not-let-the-user-delete-a-ctrl-before-a-comp.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 60c1d8f83fb641c900886d41efe018d1d01985c3
Author: Maurizio Lombardi <mlombard@xxxxxxxxxx>
Date:   Thu May 11 13:07:41 2023 +0200

    nvme: do not let the user delete a ctrl before a complete initialization
    
    [ Upstream commit 2eb94dd56a4a4e3fe286def3e2ba207804a37345 ]
    
    If a userspace application performes a "delete_controller" command
    early during the ctrl initialization, the delete operation
    may race against the init code and the kernel will crash.
    
    nvme nvme5: Connect command failed: host path error
    nvme nvme5: failed to connect queue: 0 ret=880
    PF: supervisor write access in kernel mode
    PF: error_code(0x0002) - not-present page
     blk_mq_quiesce_queue+0x18/0x90
     nvme_tcp_delete_ctrl+0x24/0x40 [nvme_tcp]
     nvme_do_delete_ctrl+0x7f/0x8b [nvme_core]
     nvme_sysfs_delete.cold+0x8/0xd [nvme_core]
     kernfs_fop_write_iter+0x124/0x1b0
     new_sync_write+0xff/0x190
     vfs_write+0x1ef/0x280
    
    Fix the crash by checking the NVME_CTRL_STARTED_ONCE bit;
    if it's not set it means that the nvme controller is still
    in the process of getting initialized and the kernel
    will return an -EBUSY error to userspace.
    Set the NVME_CTRL_STARTED_ONCE later in the nvme_start_ctrl()
    function, after the controller start operation is completed.
    
    Signed-off-by: Maurizio Lombardi <mlombard@xxxxxxxxxx>
    Reviewed-by: Sagi Grimberg <sagi@xxxxxxxxxxx>
    Reviewed-by: Christoph Hellwig <hch@xxxxxx>
    Signed-off-by: Keith Busch <kbusch@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index f502e032e7e46..2e22c78991ccf 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -3540,6 +3540,9 @@ static ssize_t nvme_sysfs_delete(struct device *dev,
 {
 	struct nvme_ctrl *ctrl = dev_get_drvdata(dev);
 
+	if (!test_bit(NVME_CTRL_STARTED_ONCE, &ctrl->flags))
+		return -EBUSY;
+
 	if (device_remove_file_self(dev, attr))
 		nvme_delete_ctrl_sync(ctrl);
 	return count;
@@ -4980,7 +4983,7 @@ void nvme_start_ctrl(struct nvme_ctrl *ctrl)
 	 * that were missed. We identify persistent discovery controllers by
 	 * checking that they started once before, hence are reconnecting back.
 	 */
-	if (test_and_set_bit(NVME_CTRL_STARTED_ONCE, &ctrl->flags) &&
+	if (test_bit(NVME_CTRL_STARTED_ONCE, &ctrl->flags) &&
 	    nvme_discovery_ctrl(ctrl))
 		nvme_change_uevent(ctrl, "NVME_EVENT=rediscover");
 
@@ -4991,6 +4994,7 @@ void nvme_start_ctrl(struct nvme_ctrl *ctrl)
 	}
 
 	nvme_change_uevent(ctrl, "NVME_EVENT=connected");
+	set_bit(NVME_CTRL_STARTED_ONCE, &ctrl->flags);
 }
 EXPORT_SYMBOL_GPL(nvme_start_ctrl);