All of lore.kernel.org
 help / color / mirror / Atom feed
From: Guixin Liu <kanie@linux.alibaba.com>
To: Keith Busch <kbusch@kernel.org>, Jens Axboe <axboe@kernel.dk>,
	Christoph Hellwig <hch@lst.de>, Sagi Grimberg <sagi@grimberg.me>,
	Hannes Reinecke <hare@suse.de>,
	Nilay Shroff <nilay@linux.ibm.com>,
	Chaitanya Kulkarni <kch@nvidia.com>
Cc: linux-nvme@lists.infradead.org
Subject: [PATCH 3/4] nvme-pci: release descriptor pools on probe failure
Date: Thu, 30 Jul 2026 12:31:04 +0800	[thread overview]
Message-ID: <20260730043105.3071328-4-kanie@linux.alibaba.com> (raw)
In-Reply-To: <20260730043105.3071328-1-kanie@linux.alibaba.com>

The per-NUMA-node descriptor DMA pools are created lazily from
nvme_init_hctx_common() once the admin tag set is allocated, but they are
only destroyed in nvme_remove() via nvme_release_descriptor_pools(). Any
probe failure after the admin tag set has been allocated unwinds through
the out_disable label and nvme_pci_free_ctrl(), neither of which releases
the pools, leaking the dma_pool objects.

Release the descriptor pools in the out_disable error path. It must not
be added to nvme_pci_free_ctrl(), as that would double-free against
nvme_remove() on the normal teardown path.

Fixes: d977506f8863 ("nvme-pci: make PRP list DMA pools per-NUMA-node")
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
---
 drivers/nvme/host/pci.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 69932d640b53..f1b24a53aa02 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -3838,6 +3838,7 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 	nvme_dev_remove_admin(dev);
 	nvme_dbbuf_dma_free(dev);
 	nvme_free_queues(dev, 0);
+	nvme_release_descriptor_pools(dev);
 out_release_iod_mempool:
 	mempool_destroy(dev->dmavec_mempool);
 out_dev_unmap:
-- 
2.43.7



  parent reply	other threads:[~2026-07-30  4:31 UTC|newest]

Thread overview: 23+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-07-30  4:31 [PATCH 0/4] nvme: a few error-path and validation fixes Guixin Liu
2026-07-30  4:31 ` [PATCH 1/4] nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist() Guixin Liu
2026-07-30  8:22   ` Hannes Reinecke
2026-07-30 11:34   ` Christoph Hellwig
2026-07-31  1:57     ` Guixin Liu
2026-07-30 12:06   ` Nilay Shroff
2026-07-30  4:31 ` [PATCH 2/4] nvmet: propagate percpu_ref_init() failure in nvmet_ns_enable() Guixin Liu
2026-07-30  8:23   ` Hannes Reinecke
2026-07-30 11:38   ` Christoph Hellwig
2026-07-30 12:06   ` Nilay Shroff
2026-07-30  4:31 ` Guixin Liu [this message]
2026-07-30  8:23   ` [PATCH 3/4] nvme-pci: release descriptor pools on probe failure Hannes Reinecke
2026-07-30 11:34   ` Christoph Hellwig
2026-07-30 11:49   ` Kanchan Joshi
2026-07-30 12:07   ` Nilay Shroff
2026-07-30  4:31 ` [PATCH 4/4] nvme: clamp FDP placement handle count to the buffer size Guixin Liu
2026-07-30  8:24   ` Hannes Reinecke
2026-07-30  9:40   ` Kanchan Joshi
2026-07-30 11:37     ` Christoph Hellwig
2026-07-30 12:41       ` Keith Busch
2026-07-31  2:00         ` Guixin Liu
2026-07-30 11:36   ` Christoph Hellwig
2026-07-30 12:08   ` Nilay Shroff

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260730043105.3071328-4-kanie@linux.alibaba.com \
    --to=kanie@linux.alibaba.com \
    --cc=axboe@kernel.dk \
    --cc=hare@suse.de \
    --cc=hch@lst.de \
    --cc=kbusch@kernel.org \
    --cc=kch@nvidia.com \
    --cc=linux-nvme@lists.infradead.org \
    --cc=nilay@linux.ibm.com \
    --cc=sagi@grimberg.me \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.