git: 19c15e41c6cd - main - nvmf_tcp: Update R2T accounting stats when aborting command buffers

The branch main has been updated by jhb:

URL: https://cgit.FreeBSD.org/src/commit/?id=19c15e41c6cdf7bb5abd89ff0ebd11c620409256

commit 19c15e41c6cdf7bb5abd89ff0ebd11c620409256
Author:     John Baldwin <jhb@FreeBSD.org>
AuthorDate: 2024-07-30 14:28:19 +0000
Commit:     John Baldwin <jhb@FreeBSD.org>
CommitDate: 2024-07-30 14:28:19 +0000

    nvmf_tcp: Update R2T accounting stats when aborting command buffers
    
    If a queue pair is destroyed (e.g. due to the TCP connection dropping)
    while a host to controller data transfer is in progress, the
    pending_r2ts counter can be non-zero.  This can later trigger an
    assertion failure when the capsule is freed.  To fix, update the
    relevant R2T accounting stats when aborting active command buffers
    during queue pair destruction.
    
    Sponsored by:   Chelsio Communications
---
 sys/dev/nvmf/nvmf_tcp.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/sys/dev/nvmf/nvmf_tcp.c b/sys/dev/nvmf/nvmf_tcp.c
index 80c75e02c9b5..135c9968d8eb 100644
--- a/sys/dev/nvmf/nvmf_tcp.c
+++ b/sys/dev/nvmf/nvmf_tcp.c
@@ -1553,6 +1553,7 @@ tcp_free_qpair(struct nvmf_qpair *nq)
 		for (u_int i = 0; i < qp->num_ttags; i++) {
 			cb = qp->open_ttags[i];
 			if (cb != NULL) {
+				cb->tc->active_r2ts--;
 				cb->error = ECONNABORTED;
 				tcp_release_command_buffer(cb);
 			}
@@ -1564,6 +1565,10 @@ tcp_free_qpair(struct nvmf_qpair *nq)
 	TAILQ_FOREACH_SAFE(cb, &qp->rx_buffers.head, link, ncb) {
 		tcp_remove_command_buffer(&qp->rx_buffers, cb);
 		mtx_unlock(&qp->rx_buffers.lock);
+#ifdef INVARIANTS
+		if (cb->tc != NULL)
+			cb->tc->pending_r2ts--;
+#endif
 		cb->error = ECONNABORTED;
 		tcp_release_command_buffer(cb);
 		mtx_lock(&qp->rx_buffers.lock);