[PATCH] nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready()

[PATCH] nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready()

[hare]

From: Hannes Reinecke <hare@kernel.org>

When the socket is closed while in TCP_LISTEN a callback is run to
flush all outstanding packets, which in turns calls
nvmet_tcp_listen_data_ready() with the sk_callback_lock held.
So we need to check if we are in TCP_LISTEN before attempting
to get the sk_callback_lock() to avoid a deadlock.

Signed-off-by: Hannes Reinecke <hare@kernel.org>
Tested-by:  Yi Zhang <yi.zhang@redhat.com>
---
 drivers/nvme/target/tcp.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
index 470bf37e5a63..2e9a3e698b70 100644
--- a/drivers/nvme/target/tcp.c
+++ b/drivers/nvme/target/tcp.c
@@ -1992,14 +1992,13 @@ static void nvmet_tcp_listen_data_ready(struct sock *sk)
 
 	trace_sk_data_ready(sk);
 
+	if (sk->sk_state != TCP_LISTEN)
+		return;
+
 	read_lock_bh(&sk->sk_callback_lock);
 	port = sk->sk_user_data;
-	if (!port)
-		goto out;
-
-	if (sk->sk_state == TCP_LISTEN)
+	if (port)
 		queue_work(nvmet_wq, &port->accept_work);
-out:
 	read_unlock_bh(&sk->sk_callback_lock);
 }
 
-- 
2.43.0

Re: [PATCH] nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready()

[Yi Zhang]

Hi Hannes

Thanks for the patch fix.
Could you also add the bug report link to this patch so that we can
get more info, like the reproducer?

On Mon, Aug 18, 2025 at 5:38 PM <hare@kernel.org> wrote:
>
> From: Hannes Reinecke <hare@kernel.org>
>
> When the socket is closed while in TCP_LISTEN a callback is run to
> flush all outstanding packets, which in turns calls
> nvmet_tcp_listen_data_ready() with the sk_callback_lock held.
> So we need to check if we are in TCP_LISTEN before attempting
> to get the sk_callback_lock() to avoid a deadlock.
>
> Signed-off-by: Hannes Reinecke <hare@kernel.org>
> Tested-by:  Yi Zhang <yi.zhang@redhat.com>
> ---
>  drivers/nvme/target/tcp.c | 9 ++++-----
>  1 file changed, 4 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
> index 470bf37e5a63..2e9a3e698b70 100644
> --- a/drivers/nvme/target/tcp.c
> +++ b/drivers/nvme/target/tcp.c
> @@ -1992,14 +1992,13 @@ static void nvmet_tcp_listen_data_ready(struct sock *sk)
>
>         trace_sk_data_ready(sk);
>
> +       if (sk->sk_state != TCP_LISTEN)
> +               return;
> +
>         read_lock_bh(&sk->sk_callback_lock);
>         port = sk->sk_user_data;
> -       if (!port)
> -               goto out;
> -
> -       if (sk->sk_state == TCP_LISTEN)
> +       if (port)
>                 queue_work(nvmet_wq, &port->accept_work);
> -out:
>         read_unlock_bh(&sk->sk_callback_lock);
>  }
>
> --
> 2.43.0
>


-- 
Best Regards,
  Yi Zhang