[PATCH] nvmet: use the local P2P device on metadata allocation failure

[PATCH] nvmet: use the local P2P device on metadata allocation failure

[Sang-Hoon Choi]

nvmet_req_alloc_p2pmem_sgls() assigns req->p2p_dev only after the data
and metadata SGL allocations succeed. If the data allocation succeeds
but the metadata allocation fails, out_free_sg passes req->p2p_dev to
pci_p2pmem_free_sgl() before that assignment has taken place.

Pass the local p2p_dev argument instead, so cleanup uses the same PCI
device as the successful data allocation.

Fixes: bcd9a0797d73 ("nvmet: fix freeing unallocated p2pmem")
Reported-by: Changyul Lee <lcy8047@gmail.com>
Link: https://github.com/lcy8047/radix-tree-bug-temp/blob/main/bug_list/idr-ida-xarray/missing-idr-lock/IDR-BUG-90-nvmet-p2p-ns-map-lookup.md
Assisted-by: Sang-Hoon Choi <csh0052@gmail.com>
Signed-off-by: Sang-Hoon Choi <csh0052@gmail.com>
---
Compile-tested on x86_64 with allmodconfig and W=1 against mainline
6f8319e3e9a44dd537d17f41565a8453c560a581. No P2P hardware or metadata
allocation failure test was performed.

 drivers/nvme/target/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
index 43871a8f56ca..9ef29b2b49de 100644
--- a/drivers/nvme/target/core.c
+++ b/drivers/nvme/target/core.c
@@ -1317,7 +1317,7 @@ static int nvmet_req_alloc_p2pmem_sgls(struct pci_dev *p2p_dev,
 
 	return 0;
 out_free_sg:
-	pci_p2pmem_free_sgl(req->p2p_dev, req->sg);
+	pci_p2pmem_free_sgl(p2p_dev, req->sg);
 out_err:
 	return -ENOMEM;
 }
-- 
2.43.0

Re: [PATCH] nvmet: use the local P2P device on metadata allocation failure

[Maurizio Lombardi]

On Wed Sep 30, 2026 at 9:08 AM CEST, Sang-Hoon Choi wrote:
> nvmet_req_alloc_p2pmem_sgls() assigns req->p2p_dev only after the data
> and metadata SGL allocations succeed. If the data allocation succeeds
> but the metadata allocation fails, out_free_sg passes req->p2p_dev to
> pci_p2pmem_free_sgl() before that assignment has taken place.
>
> Pass the local p2p_dev argument instead, so cleanup uses the same PCI
> device as the successful data allocation.
>
> Fixes: bcd9a0797d73 ("nvmet: fix freeing unallocated p2pmem")
> Reported-by: Changyul Lee <lcy8047@gmail.com>
> Link: https://github.com/lcy8047/radix-tree-bug-temp/blob/main/bug_list/idr-ida-xarray/missing-idr-lock/IDR-BUG-90-nvmet-p2p-ns-map-lookup.md

This link gives 404 to me but anyway the patch looks ok

Reviewed-by: Maurizio Lombardi <mlombard@redhat.com>


> Assisted-by: Sang-Hoon Choi <csh0052@gmail.com>
> Signed-off-by: Sang-Hoon Choi <csh0052@gmail.com>
> ---
> Compile-tested on x86_64 with allmodconfig and W=1 against mainline
> 6f8319e3e9a44dd537d17f41565a8453c560a581. No P2P hardware or metadata
> allocation failure test was performed.
>
>  drivers/nvme/target/core.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
> index 43871a8f56ca..9ef29b2b49de 100644
> --- a/drivers/nvme/target/core.c
> +++ b/drivers/nvme/target/core.c
> @@ -1317,7 +1317,7 @@ static int nvmet_req_alloc_p2pmem_sgls(struct pci_dev *p2p_dev,
>  
>  	return 0;
>  out_free_sg:
> -	pci_p2pmem_free_sgl(req->p2p_dev, req->sg);
> +	pci_p2pmem_free_sgl(p2p_dev, req->sg);
>  out_err:
>  	return -ENOMEM;
>  }

Re: [PATCH] nvmet: use the local P2P device on metadata allocation failure

[Keith Busch]

On Wed, Sep 30, 2026 at 04:08:58PM +0900, Sang-Hoon Choi wrote:
> nvmet_req_alloc_p2pmem_sgls() assigns req->p2p_dev only after the data
> and metadata SGL allocations succeed. If the data allocation succeeds
> but the metadata allocation fails, out_free_sg passes req->p2p_dev to
> pci_p2pmem_free_sgl() before that assignment has taken place.
> 
> Pass the local p2p_dev argument instead, so cleanup uses the same PCI
> device as the successful data allocation.

Thanks, applied to nvme-7.3.