Re: [PATCH v3 06/10] nvme-multipath: add uring_cmd support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Polling thread accesses a freed request if it completes asynchronously via a timeout or abortion.
--

commit 26f589fad741b01889fb3c28f4f60f8b1eb60783
Author: John Garry <john.g.garry@oracle.com>

nvme-multipath: add uring_cmd support

This commit adds uring_cmd support to NVMe multipath devices by introducing
the nvme_mpath_chr_uring_cmd callback. It also wires up the existing
nvme_ns_chr_uring_cmd_iopoll for io_uring polling.

> diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
> index 9a1703f01ef60..b27b45c59c883 100644
> --- a/drivers/nvme/host/multipath.c
> +++ b/drivers/nvme/host/multipath.c
[ ... ]
> @@ -1554,4 +1554,6 @@ static const struct mpath_head_template mpdt = {
>  	.cdev_ioctl = nvme_mpath_cdev_ioctl,
>  	.ioctl_begin = nvme_mpath_ioctl_begin,
>  	.ioctl_finish = nvme_mpath_ioctl_finish,
> +	.chr_uring_cmd = nvme_mpath_chr_uring_cmd,
> +	.chr_uring_cmd_iopoll = nvme_ns_chr_uring_cmd_iopoll,

[Severity: High]
This is a pre-existing issue, but does assigning nvme_ns_chr_uring_cmd_iopoll()
here expose a use-after-free for multipath devices if a command times out?

Looking at nvme_uring_cmd_end_io(), if a command completes asynchronously
or times out, the handler frees the request by returning RQ_END_IO_FREE,
but it appears to leave pdu->req set:

nvme_uring_cmd_end_io() {
    ...
    } else {
        io_uring_cmd_do_in_task_lazy(ioucmd, nvme_uring_task_cb);
    }
    return RQ_END_IO_FREE;
}

Since pdu->req isn't cleared, if the polling thread continues to spin in
nvme_ns_chr_uring_cmd_iopoll(), won't it dereference the freed request?

nvme_ns_chr_uring_cmd_iopoll() {
    ...
    struct request *req = pdu->req;

    if (req && blk_rq_is_poll(req))
        return blk_rq_poll(req, iob, poll_flags);
    ...
}

>  };

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260703103204.3724406-1-john.g.garry@oracle.com?part=6