[PATCH] nvme: fix racy access to FDP placement id array

[Christoph Hellwig]

On Mon, Aug 17, 2026 at 02:52:42PM +0530, Kanchan Joshi wrote:
> On 8/17/2026 1:53 PM, Christoph Hellwig wrote:
> >> +	if (ctrl->ctratt & NVME_CTRL_ATTR_FDPS) {
> >> +		ns->head = head;
> >> +		ret = nvme_query_fdp_info(ns, info);
> >> +		if (ret < 0)
> >> +			goto out_clear_ns_head;
> >> +	}
> > The conditional assignment of ns->head here is weird.  Just pass it
> > explicitly to nvme_query_fdp_info so that you don't have this issue.
> 
> ns->head is required even beyond nvme_query_fdp_info().
> 
> nvme_query_fdp_info(..)
> -> nvme_submit_sync_cmd(ns->queue, &c, ruhs, size);
>   -> __nvme_submit_sync_cmd(...);
>    -> nvme_init_request();
> 
> Which is going to touch ns->head here:
>           if (req->q->queuedata) {
>                   struct nvme_ns *ns = req->q->disk->private_data;
> 
>                   logging_enabled = ns->head->passthru_err_log_enabled;
> 	}

Then we'll need to assign it earlier unconditionally instead in a prep
patch.