[PATCH] nvmet-tcp: fix a hang on queue teardown with data digest

[Shivam Kumar <kumar.shivam43666@gmail.com>]

With data digest on, a command that has received all its data waits for
the digest in NVMET_TCP_RECV_DDGST. has_data_in() is already false there,
so need_data_in() is too, and nvmet_tcp_uninit_data_in_cmds() skips it on
teardown even though it still holds the nvmet_req_init() reference. The SQ
percpu_ref never drains, nvmet_sq_destroy() blocks forever in
wait_for_completion(), and the nvmet-wq release worker is stuck.

An unauthenticated host on an allow_any_host subsystem hits this by
negotiating data digest, sending a write's data but not the trailing
digest, and closing the connection. Each leaked command wedges a release
worker; a few stall queue teardown entirely, and with hung_task_panic the
box goes down.

Drop the reference for a command left in RECV_DDGST from
nvmet_tcp_release_queue_work(), before rcv_state is cleared. A command
that failed nvmet_req_init() never took one, so skip it.

Fixes: 872d26a391da ("nvmet-tcp: add NVMe over TCP target driver")
Cc: stable@vger.kernel.org
Signed-off-by: Shivam Kumar <kumar.shivam43666@gmail.com>
Assisted-by: Claude
---
 drivers/nvme/target/tcp.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

--- a/drivers/nvme/target/tcp.c
+++ b/drivers/nvme/target/tcp.c
@@ -1640,6 +1640,19 @@
 	nvmet_tcp_restore_socket_callbacks(queue);
 	cancel_delayed_work_sync(&queue->tls_handshake_tmo_work);
 	cancel_work_sync(&queue->io_work);
+
+	/*
+	 * A command that has received all of its data and is only waiting
+	 * for the data digest sits in RECV_DDGST: need_data_in() is already
+	 * false, so nvmet_tcp_uninit_data_in_cmds() below skips it, yet it
+	 * still holds the reference from nvmet_req_init(). Drop it here,
+	 * while rcv_state still reflects it, so the SQ percpu_ref can drain
+	 * and nvmet_sq_destroy() can complete. INIT_FAILED took no ref.
+	 */
+	if (queue->rcv_state == NVMET_TCP_RECV_DDGST && queue->cmd &&
+	    !(queue->cmd->flags & NVMET_TCP_F_INIT_FAILED))
+		nvmet_req_uninit(&queue->cmd->req);
+
 	/* stop accepting incoming data */
 	queue->rcv_state = NVMET_TCP_RECV_ERR;
 
-- 
2.34.1