From: Daniel Wagner Date: Wed, 7 May 2025 12:23:07 +0000 (+0200) Subject: nvmet-fcloop: drop response if targetport is gone X-Git-Url: https://www.infradead.org/git/?a=commitdiff_plain;h=84eedced1c5b84fe4f9740e4594b2dc99b569388;p=users%2Fdwmw2%2Flinux.git nvmet-fcloop: drop response if targetport is gone When the target port is gone, the lsrsp pointer is invalid. Thus don't call the done function anymore instead just drop the response. This happens when the target sends a disconnect association. After this the target starts tearing down all resources and doesn't expect any response. Signed-off-by: Daniel Wagner Reviewed-by: Hannes Reinecke Signed-off-by: Christoph Hellwig --- diff --git a/drivers/nvme/target/fcloop.c b/drivers/nvme/target/fcloop.c index b952672f38cbd..4c60eaf0b653b 100644 --- a/drivers/nvme/target/fcloop.c +++ b/drivers/nvme/target/fcloop.c @@ -494,16 +494,25 @@ fcloop_t2h_xmt_ls_rsp(struct nvme_fc_local_port *localport, struct nvmet_fc_target_port *targetport = rport->targetport; struct fcloop_tport *tport; - memcpy(lsreq->rspaddr, lsrsp->rspbuf, - ((lsreq->rsplen < lsrsp->rsplen) ? - lsreq->rsplen : lsrsp->rsplen)); - lsrsp->done(lsrsp); - if (!targetport) { + /* + * The target port is gone. The target doesn't expect any + * response anymore and the ->done call is not valid + * because the resources have been freed by + * nvmet_fc_free_pending_reqs. + * + * We end up here from delete association exchange: + * nvmet_fc_xmt_disconnect_assoc sends an async request. + */ kmem_cache_free(lsreq_cache, tls_req); return 0; } + memcpy(lsreq->rspaddr, lsrsp->rspbuf, + ((lsreq->rsplen < lsrsp->rsplen) ? + lsreq->rsplen : lsrsp->rsplen)); + lsrsp->done(lsrsp); + tport = targetport->private; spin_lock(&tport->lock); list_add_tail(&tls_req->ls_list, &tport->ls_list);