Re: [PATCH] nvmet: copy the hostid into the ctrl before creating PR pc_refs

[Daniel Wagner <dwagner@suse.de>]

On Wed, Sep 16, 2026 at 07:42:54PM +0800, Guixin Liu wrote:
> Commit 6202783184bf ("nvmet: Improve nvmet_alloc_ctrl() interface and
> implementation") added a second uuid_copy() of args->hostid near the end
> of nvmet_alloc_ctrl(), and commit 7b658153f1b8 ("nvmet: Remove duplicate
> uuid_copy") removed the original copy that sat before
> nvmet_ctrl_init_pr() instead of the new one.
> 
> Since then nvmet_ctrl_init_pr() snapshots ctrl->hostid into the
> per-controller per-namespace reservation refs while the uuid_copy()
> from the connect data runs later, after the controller is published.
> The ctrl is allocated with kzalloc(), so every pc_ref created on this
> path stores the nil UUID.
> 
> pc_ref->hostid has a single consumer: nvmet_pr_set_ctrl_to_abort()
> matches it against the preempted registrant's hostid to kill and drain
> the victim's in-flight I/O for Preempt and Abort.  The match can never
> hit with the nil UUID, so whenever a namespace with reservations
> enabled exists before a host connects, which includes every reconnect,
> Preempt and Abort silently degrades into a plain Preempt: the
> preempting host sees success while the victim's in-flight I/O is still
> in the air.
> 
> Copy the hostid where the rest of the connect data is consumed, before
> the controller is published and before nvmet_ctrl_init_pr() takes its
> snapshot.
> 
> Fixes: 7b658153f1b8 ("nvmet: Remove duplicate uuid_copy")
> Cc: stable@vger.kernel.org
> Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>

Besides fixing this bug, it makes more sense to pair the hostid memcpy
with the hostnqn one.

Reviewed-by: Daniel Wagner <dwagner@suse.de>