[PATCH] nvme: fix racy access to FDP placement id array

[PATCH] nvme: fix racy access to FDP placement id array

[Kanchan Joshi]

nvme_query_fdp_info() is called per-path and therefore prone to races.

It populates head->nr_plids/head->plids for fdp registration.
But nothing protects that pair from concurrent access - two paths scanning
the same namespace can race to populate it.

Avoid the race by moving this initialization work to nvme_alloc_ns_head()
which is called once per shared namespace.

Fixes: 30b5f20bb2dd ("nvme: register fdp parameters with the block layer")
Reported-by: Hari Mishal <harimishal1@gmail.com>
Link: https://lore.kernel.org/linux-nvme/20260725135111.14041-2-harimishal1@gmail.com/
Signed-off-by: Kanchan Joshi <joshi.k@samsung.com>
---
 drivers/nvme/host/core.c | 38 +++++++++++++++++---------------------
 drivers/nvme/host/nvme.h |  1 +
 2 files changed, 18 insertions(+), 21 deletions(-)

diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 1322c678f4eb..c62c8f37979b 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -2341,14 +2341,6 @@ static int nvme_query_fdp_info(struct nvme_ns *ns, struct nvme_ns_info *info)
 	size_t size;
 	int i, ret;
 
-	/*
-	 * The FDP configuration is static for the lifetime of the namespace,
-	 * so return immediately if we've already registered this namespace's
-	 * streams.
-	 */
-	if (head->nr_plids)
-		return 0;
-
 	ret = nvme_get_features(ctrl, NVME_FEAT_FDP, info->endgid, NULL, 0,
 				&fdp);
 	if (ret) {
@@ -2395,6 +2387,7 @@ static int nvme_query_fdp_info(struct nvme_ns *ns, struct nvme_ns_info *info)
 
 	for (i = 0; i < head->nr_plids; i++)
 		head->plids[i] = le16_to_cpu(ruhs->ruhsd[i].pid);
+	head->write_stream_granularity = min(info->runs, U32_MAX);
 free:
 	kfree(ruhs);
 	return ret;
@@ -2442,12 +2435,6 @@ static int nvme_update_ns_info_block(struct nvme_ns *ns,
 			goto out;
 	}
 
-	if (ns->ctrl->ctratt & NVME_CTRL_ATTR_FDPS) {
-		ret = nvme_query_fdp_info(ns, info);
-		if (ret < 0)
-			goto out;
-	}
-
 	if (nvme_invalid_lba_sz(le64_to_cpu(id->nsze),
 			id->lbaf[lbaf].ds - SECTOR_SHIFT, &capacity)) {
 		dev_warn_once(ns->ctrl->device,
@@ -2490,10 +2477,7 @@ static int nvme_update_ns_info_block(struct nvme_ns *ns,
 		capacity = 0;
 
 	lim.max_write_streams = ns->head->nr_plids;
-	if (lim.max_write_streams)
-		lim.write_stream_granularity = min(info->runs, U32_MAX);
-	else
-		lim.write_stream_granularity = 0;
+	lim.write_stream_granularity = ns->head->write_stream_granularity;
 
 	/*
 	 * Only set the DEAC bit if the device guarantees that reads from
@@ -4001,10 +3985,11 @@ static void nvme_add_ns_cdev(struct nvme_ns *ns)
 	set_bit(NVME_NS_CDEV_LIVE, &ns->flags);
 }
 
-static struct nvme_ns_head *nvme_alloc_ns_head(struct nvme_ctrl *ctrl,
+static struct nvme_ns_head *nvme_alloc_ns_head(struct nvme_ns *ns,
 		struct nvme_ns_info *info)
 	__must_hold(&ctrl->subsys->lock)
 {
+	struct nvme_ctrl *ctrl = ns->ctrl;
 	struct nvme_ns_head *head;
 	size_t size = sizeof(*head);
 	int ret = -ENOMEM;
@@ -4040,15 +4025,26 @@ static struct nvme_ns_head *nvme_alloc_ns_head(struct nvme_ctrl *ctrl,
 	} else
 		head->effects = ctrl->effects;
 
+	if (ctrl->ctratt & NVME_CTRL_ATTR_FDPS) {
+		ns->head = head;
+		ret = nvme_query_fdp_info(ns, info);
+		if (ret < 0)
+			goto out_clear_ns_head;
+	}
+
 	ret = nvme_mpath_alloc_disk(ctrl, head);
 	if (ret)
-		goto out_cleanup_srcu;
+		goto out_cleanup_fdp;
 
 	list_add_tail(&head->entry, &ctrl->subsys->nsheads);
 
 	kref_get(&ctrl->subsys->ref);
 
 	return head;
+out_cleanup_fdp:
+	kfree(head->plids);
+out_clear_ns_head:
+	ns->head = NULL;
 out_cleanup_srcu:
 	cleanup_srcu_struct(&head->srcu);
 out_ida_remove:
@@ -4141,7 +4137,7 @@ static int nvme_init_ns_head(struct nvme_ns *ns, struct nvme_ns_info *info)
 				info->nsid);
 			goto out_unlock;
 		}
-		head = nvme_alloc_ns_head(ctrl, info);
+		head = nvme_alloc_ns_head(ns, info);
 		if (IS_ERR(head)) {
 			ret = PTR_ERR(head);
 			goto out_unlock;
diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
index 75e5d5a8a77c..c20e8ef8baa0 100644
--- a/drivers/nvme/host/nvme.h
+++ b/drivers/nvme/host/nvme.h
@@ -571,6 +571,7 @@ struct nvme_ns_head {
 
 	u16			nr_plids;
 	u16			*plids;
+	u32			write_stream_granularity;
 #ifdef CONFIG_NVME_MULTIPATH
 	struct bio_list		requeue_list
 		__guarded_by(&requeue_lock);
-- 
2.25.1

Re: [PATCH] nvme: fix racy access to FDP placement id array

[Christoph Hellwig]

> +	if (ctrl->ctratt & NVME_CTRL_ATTR_FDPS) {
> +		ns->head = head;
> +		ret = nvme_query_fdp_info(ns, info);
> +		if (ret < 0)
> +			goto out_clear_ns_head;
> +	}

The conditional assignment of ns->head here is weird.  Just pass it
explicitly to nvme_query_fdp_info so that you don't have this issue.

Otherwise the patch looks good.

Re: [PATCH] nvme: fix racy access to FDP placement id array

[Kanchan Joshi]

On 8/17/2026 1:53 PM, Christoph Hellwig wrote:
>> +	if (ctrl->ctratt & NVME_CTRL_ATTR_FDPS) {
>> +		ns->head = head;
>> +		ret = nvme_query_fdp_info(ns, info);
>> +		if (ret < 0)
>> +			goto out_clear_ns_head;
>> +	}
> The conditional assignment of ns->head here is weird.  Just pass it
> explicitly to nvme_query_fdp_info so that you don't have this issue.

ns->head is required even beyond nvme_query_fdp_info().

nvme_query_fdp_info(..)
-> nvme_submit_sync_cmd(ns->queue, &c, ruhs, size);
  -> __nvme_submit_sync_cmd(...);
   -> nvme_init_request();

Which is going to touch ns->head here:
          if (req->q->queuedata) {
                  struct nvme_ns *ns = req->q->disk->private_data;

                  logging_enabled = ns->head->passthru_err_log_enabled;
	}

Re: [PATCH] nvme: fix racy access to FDP placement id array

[Christoph Hellwig]

On Mon, Aug 17, 2026 at 02:52:42PM +0530, Kanchan Joshi wrote:
> On 8/17/2026 1:53 PM, Christoph Hellwig wrote:
> >> +	if (ctrl->ctratt & NVME_CTRL_ATTR_FDPS) {
> >> +		ns->head = head;
> >> +		ret = nvme_query_fdp_info(ns, info);
> >> +		if (ret < 0)
> >> +			goto out_clear_ns_head;
> >> +	}
> > The conditional assignment of ns->head here is weird.  Just pass it
> > explicitly to nvme_query_fdp_info so that you don't have this issue.
> 
> ns->head is required even beyond nvme_query_fdp_info().
> 
> nvme_query_fdp_info(..)
> -> nvme_submit_sync_cmd(ns->queue, &c, ruhs, size);
>   -> __nvme_submit_sync_cmd(...);
>    -> nvme_init_request();
> 
> Which is going to touch ns->head here:
>           if (req->q->queuedata) {
>                   struct nvme_ns *ns = req->q->disk->private_data;
> 
>                   logging_enabled = ns->head->passthru_err_log_enabled;
> 	}

Then we'll need to assign it earlier unconditionally instead in a prep
patch.