[PATCHv2] nvmet: Fix crash when a namespace is disabled

[Shinichiro Kawasaki]

On Feb 07, 2025 / 13:41, Hannes Reinecke wrote:
> The namespace percpu counter protects pending I/O, and we can
> only safely diable the namespace once the counter drop to zero.
> Otherwise we end up with a crash when running blktests/nvme/058
> (eg for loop transport):
> 
> [ 2352.930426] [  T53909] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] PREEMPT SMP KASAN PTI
> [ 2352.930431] [  T53909] KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
> [ 2352.930434] [  T53909] CPU: 3 UID: 0 PID: 53909 Comm: kworker/u16:5 Tainted: G        W          6.13.0-rc6 #232
> [ 2352.930438] [  T53909] Tainted: [W]=WARN
> [ 2352.930440] [  T53909] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014
> [ 2352.930443] [  T53909] Workqueue: nvmet-wq nvme_loop_execute_work [nvme_loop]
> [ 2352.930449] [  T53909] RIP: 0010:blkcg_set_ioprio+0x44/0x180
> 
> as the queue is already torn down when calling submit_bio();
> 
> So we need to init the percpu counter in nvmet_ns_enable(), and
> wait for it to drop to zero in nvmet_ns_disable() to avoid having
> I/O pending after the namespace has been disabled.
> 
> Fixes: 74d16965d7ac ("nvmet-loop: avoid using mutex in IO hotpath")
> 
> Signed-off-by: Hannes Reinecke <hare at kernel.org>
> Reviewed-by: Nilay Shroff <nilay at linux.ibm.com>

I confirmed that this fix avoids the blktests failure at nvme/058. I also
run all blktests test cases and observed no regression. Thanks!

Tested-by: Shin'ichiro Kawasaki <shinichiro.kawasaki at wdc.com>