vhost_scsi_clear_endpoint() checks every virtqueue with
vhost_vq_access_ok() before disabling the backends and waiting for
in-flight SCSI commands. If that check fails, endpoint teardown is
skipped.
vhost_scsi_release() ignores the error and frees the vhost-scsi state.
vhost_dev_stop() drains vhost work, but it does not wait for commands
owned by the target core. A later command or TMF completion can therefore
dereference its saved virtqueue pointer after the virtqueue has been freed.
Vring access is not a prerequisite for tearing an endpoint down. Remove
the check so teardown always disables the backends and waits for in-flight
commands before releasing their state.
Fixes: 057cbf49a1f0 ("tcm_vhost: Initial merge for vhost level target fabric
driver")
Signed-off-by: Yuho Choi <[email protected]>
---
drivers/vhost/scsi.c | 9 +--------
1 file changed, 1 insertion(+), 8 deletions(-)
diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index e44044449cef..f0966f25b09a 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -2194,17 +2194,10 @@ vhost_scsi_clear_endpoint(struct vhost_scsi *vs,
struct vhost_scsi_tpg *tpg;
struct vhost_virtqueue *vq;
bool match = false;
- int index, ret, i;
+ int ret, i;
u8 target;
mutex_lock(&vs->dev.mutex);
- /* Verify that ring has been setup correctly. */
- for (index = 0; index < vs->dev.nvqs; ++index) {
- if (!vhost_vq_access_ok(&vs->vqs[index].vq)) {
- ret = -EFAULT;
- goto err_dev;
- }
- }
if (!vs->vs_tpg) {
ret = 0;
--
2.43.0
