Re: [PATCH v7 02/17] nvmet/debugfs: Export controller CIU and CIRN via debugfs

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] nvmet: torn 64-bit read of ctrl->cirn in
  nvmet_ctrl_instance_cirn_show()
--

commit 70231338c7dc52cc534009767cd7997ab988025e
Author: Mohamed Khalfella <mkhalfella@purestorage.com>

nvmet/debugfs: Export controller CIU and CIRN via debugfs

This commit exports a target controller's CIU and CIRN fields as debugfs
attributes under the controller's debugfs directory.

> diff --git a/drivers/nvme/target/debugfs.c b/drivers/nvme/target/debugfs.c
> index e85fe1d4c9f8d..221fa81e124fe 100644
> --- a/drivers/nvme/target/debugfs.c
> +++ b/drivers/nvme/target/debugfs.c
> @@ -153,6 +153,24 @@ static int nvmet_ctrl_tls_concat_show(struct seq_file *m, void *p)
>  NVMET_DEBUGFS_ATTR(nvmet_ctrl_tls_concat);
>  #endif
>  
> +static int nvmet_ctrl_instance_ciu_show(struct seq_file *m, void *p)
> +{
> +	struct nvmet_ctrl *ctrl = m->private;
> +
> +	seq_printf(m, "%02x\n", ctrl->ciu);
> +	return 0;
> +}
> +NVMET_DEBUGFS_ATTR(nvmet_ctrl_instance_ciu);
> +
> +static int nvmet_ctrl_instance_cirn_show(struct seq_file *m, void *p)
> +{
> +	struct nvmet_ctrl *ctrl = m->private;
> +
> +	seq_printf(m, "%016llx\n", ctrl->cirn);
> +	return 0;
> +}
> +NVMET_DEBUGFS_ATTR(nvmet_ctrl_instance_cirn);

[Severity: Low]
Can nvmet_ctrl_instance_cirn_show() observe a torn 64-bit read of
ctrl->cirn on 32-bit architectures?

nvmet_alloc_ctrl() calls nvmet_debugfs_ctrl_setup() before the host
enables the controller, and nvmet_update_cc() -> nvmet_start_ctrl() later
writes a new 64-bit value to ctrl->cirn under ctrl->lock whenever the
controller is enabled or re-enabled.  Reading ctrl->cirn without holding
ctrl->lock races with that update and can report a corrupted mix of the
old and new values to userspace.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261114030454.2836543-1-mkhalfella@purestorage.com?part=2