[PATCH] nvme: Add module reference counting for multipath nvme device

[John Garry]

On 11/08/2026 19:54, Wen Xiong wrote:
>> Can you demonstrate that this is a problem?
>> 
> For example, the Linux root filesystem is located on a multipath NVMe
> device. During system boot, the reference count of the nvme module is
> zero. As a result, the tester can run rmmod nvme, which causes the
> system to become unstable or crash.
> 

Can't the tester also just unbind the device from the driver, which does 
the same (as unloading the driver)?

Example:
echo 0000:00:04.0  > /sys/bus/pci/drivers/nvme/unbind

For this PCI case, we call nvme_remove() -> nvme_remove_namespaces() -> 
nvme_ns_remove(), which removes the NS path and deletes the gendisk if 
the last path. Same effect, as I see.

> linux was installed on /dev/nvme4n2.
> #lsmod|grep nvme
> nvme_fabrics          262144  0
> nvme                  262144  0 ----> reference count = 0 for nvme
> module.
> nvme_core             458752  4 nvme,nvme_fabrics
> nvme_keyring          262144  2 nvme_core,nvme_fabrics
> nvme_auth             262144  1 nvme_core
> #  rmmod nvme
> [11312.100786][  T937] BTRFS error (device nvme4n1p2): bdev
> /dev/nvme4n1p2 errs: wr 1, rd 0, flush 0, corrupt 0, gen 0
> [11312.100855][  T937] BTRFS error (device nvme4n1p2): bdev
> /dev/nvme4n1p2 errs: wr 2, rd 0, flush 0, corrupt 0, gen 0
> [11338.724061][  T624] BTRFS error (device nvme4n1p2 state A):
> Transaction aborted (error -5)
> [11338.724075][  T624] BTRFS: error (device nvme4n1p2 state A) in
> __btrfs_update_delayed_inode:1096: errno=-5 IO failure
> # ls
> ls: reading directory '.': Input/output error
> 
> In the current nvme module reference count increase/decrease logic, the
> operation is skipped when the device is a multipath device. As a result,
> the NVMe module reference count remains zero even though the NVMe device
> is actively being used by the multipath stack.
> 
> static int nvme_ns_open(struct nvme_ns *ns)
> {
> 
>            /* should never be called due to GENHD_FL_HIDDEN */
>            if (WARN_ON_ONCE(nvme_ns_head_multipath(ns->head)))
>                    goto fail;
>            if (!nvme_get_ns(ns))
>                    goto fail;
>            if (!try_module_get(ns->ctrl->ops->module))
>                    goto fail_put_ns;
> 
> This patch adds module reference count increase/decrease logic in
> nvme_ns_head_open() and nvme_ns_head_release() for the multipath head
> device. This mirrors the behavior of nvme_ns_open() for non-multipath
> devices.