Re: [PATCH 2/4] nvmet: propagate percpu_ref_init() failure in nvmet_ns_enable()

On 7/30/26 6:31 AM, Guixin Liu wrote:
> The return value of percpu_ref_init() is discarded. At this point ret is
> 0 from the preceding successful steps, so when the allocation inside
> percpu_ref_init() fails the code jumps to the out_pr_exit cleanup chain
> which ends with "return ret", i.e. reports success. The configfs enable
> store then tells userspace the namespace was enabled even though it was
> not and its backing device has already been torn down.
> 
> Capture the return value so the failure is propagated.
> 
> Fixes: 408232680707 ("nvmet: Fix crash when a namespace is disabled")
> Signed-off-by: Guixin Liu <[email protected]>
> ---
>   drivers/nvme/target/core.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
> index 4477c4d6b1ee..c8e01dda4121 100644
> --- a/drivers/nvme/target/core.c
> +++ b/drivers/nvme/target/core.c
> @@ -610,7 +610,8 @@ int nvmet_ns_enable(struct nvmet_ns *ns)
>   			goto out_dev_put;
>   	}
>   
> -	if (percpu_ref_init(&ns->ref, nvmet_destroy_namespace, 0, GFP_KERNEL))
> +	ret = percpu_ref_init(&ns->ref, nvmet_destroy_namespace, 0, GFP_KERNEL);
> +	if (ret)
>   		goto out_pr_exit;
>   
>   	nvmet_ns_changed(subsys, ns->nsid);

Reviewed-by: Hannes Reinecke <[email protected]>

Cheers,

Hannes
-- 
Dr. Hannes Reinecke                  Kernel Storage Architect
[email protected]                                +49 911 74053 688
SUSE Software Solutions GmbH, Frankenstr. 146, 90461 Nürnberg
HRB 36809 (AG Nürnberg), GF: I. Totev, A. McDonald, W. Knoblich