From 32f86a5f34fbaa62c482cef1a83412f793d34527 Mon Sep 17 00:00:00 2001 From: Dariusz Stojaczyk Date: Mon, 17 Jul 2017 12:00:08 +0200 Subject: [PATCH] bdev: don't call recursively desc->remove_cb on bdev removal When device has more than one open descriptor, remove_cbs of particular descriptors could be called more than once. Consider the following scenario: bdev X with 2 open descriptors A and B. X is removed (hotremoved for instance) bdev_unregister(X) is called * bdev->status = REMOVING * A->remove_cb is called * some poller is started * B->remove_cb is called * another poller started * poller from A->remove_cb finishes it's work and closes the desc: * bdev_close(A) * A is removed from bdev->open_descs list * bdev->status is REMOVING, so bdev_unregister(X) is called again! * B->remove cb is called again! * another poller starts? segfault? Fixes: 57d174ff6797 ("bdev: add spdk_bdev_open/close") Change-Id: I0a898ec0aee521d0b2a1168fe7d469cc41a8ef4f Signed-off-by: Dariusz Stojaczyk Reviewed-on: https://review.gerrithub.io/369727 Reviewed-by: Daniel Verkamp Tested-by: SPDK Automated Test System Reviewed-by: Ben Walker --- lib/bdev/bdev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/bdev/bdev.c b/lib/bdev/bdev.c index 25250f5ae4..ba83077c2e 100644 --- a/lib/bdev/bdev.c +++ b/lib/bdev/bdev.c @@ -1560,7 +1560,7 @@ spdk_bdev_close(struct spdk_bdev_desc *desc) TAILQ_REMOVE(&bdev->open_descs, desc, link); free(desc); - if (bdev->status == SPDK_BDEV_STATUS_REMOVING) { + if (bdev->status == SPDK_BDEV_STATUS_REMOVING && TAILQ_EMPTY(&bdev->open_descs)) { do_unregister = true; } pthread_mutex_unlock(&bdev->mutex);