IB/srp: Keep rport as long as the IB transport layer

Keep the rport data structure around after srp_remove_host() has
finished until cleanup of the IB transport layer has finished
completely. This is necessary because later patches use the rport
pointer inside the queuecommand callback. Without this patch
accessing the rport from inside a queuecommand callback is racy
because srp_remove_host() must be invoked before scsi_remove_host()
and because the queuecommand callback could get invoked after
srp_remove_host() has finished. In other words, without this patch
the queuecommand callback can get invoked after the rport data
structure has been freed.

Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Acked-by: David Dillow <dillowda@ornl.gov>
Signed-off-by: Roland Dreier <roland@purestorage.com>

1 files changed, 3 insertions, 0 deletions

diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index 11ebf3e7646a..6edab7855f5e 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -528,11 +528,13 @@ static void srp_remove_target(struct srp_target_port *target)
         WARN_ON_ONCE(target->state != SRP_TARGET_REMOVED);
 
         srp_del_scsi_host_attr(target->scsi_host);
+        srp_rport_get(target->rport);
         srp_remove_host(target->scsi_host);
         scsi_remove_host(target->scsi_host);
         srp_disconnect_target(target);
         ib_destroy_cm_id(target->cm_id);
         srp_free_target_ib(target);
+        srp_rport_put(target->rport);
         srp_free_req_data(target);
         scsi_host_put(target->scsi_host);
 }
@@ -2004,6 +2006,7 @@ static int srp_add_target(struct srp_host *host, struct srp_target_port *target)
         }
 
         rport->lld_data = target;
+        target->rport = rport;
 
         spin_lock(&host->target_lock);
         list_add_tail(&target->list, &host->target_list);