• Igor Konopko's avatar
    nvme-pci: fix surprise removal · 751a0cc0
    Igor Konopko authored
    When a PCIe NVMe device is not present, nvme_dev_remove_admin() calls
    blk_cleanup_queue() on the admin queue, which frees the hctx for that
    queue.  Moments later, on the same path nvme_kill_queues() calls
    blk_mq_unquiesce_queue() on admin queue and tries to access hctx of it,
    which leads to following OOPS:
    
    Oops: 0000 [#1] SMP PTI
    RIP: 0010:sbitmap_any_bit_set+0xb/0x40
    Call Trace:
     blk_mq_run_hw_queue+0xd5/0x150
     blk_mq_run_hw_queues+0x3a/0x50
     nvme_kill_queues+0x26/0x50
     nvme_remove_namespaces+0xb2/0xc0
     nvme_remove+0x60/0x140
     pci_device_remove+0x3b/0xb0
    
    Fixes: cb4bfda6 ("nvme-pci: fix hot removal during error handling")
    Signed-off-by: default avatarIgor Konopko <igor.j.konopko@intel.com>
    Reviewed-by: default avatarKeith Busch <keith.busch@intel.com>
    Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
    751a0cc0
core.c 93.3 KB