[PATCH RFC] nvme: fix NS head cdev lifetime

[John Garry]

On 08/07/2026 10:57, John Garry wrote:
> On 08/07/2026 10:27, Christoph Hellwig wrote:
> 

JFYI, this is also an issue for non-multipath, so both need to be fixed:

# ./ioctl_file /dev/ng0n1
waiting 10 seconds ....
now going to issue ioctl ....
retl=-1
# ./ioctl_file /dev/ng0n1  &
# waiting 10 seconds ....
echo "0000:00:04.0" > /sys/bus/pci/drivers/nvme/unbind
# now going to issue ioctl ....
retl=-1
[   57.145946] 
==================================================================
[   57.147504] BUG: KASAN: slab-use-after-free in cdev_put.part.0+0x3d/0x40
[   57.149479] Read of size 8 at addr ffff888105cee0b0 by task 
ioctl_file/230
[   57.150890]
[   57.151251] CPU: 1 UID: 0 PID: 230 Comm: ioctl_file Not tainted
7.2.0-rc1-00002-g54ab7087cd7c #943 PREEMPT(lazy)
[   57.151259] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009),
BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   57.151263] Call Trace:
[   57.151268]  <TASK>
[   57.151272]  dump_stack_lvl+0x68/0xa0
[   57.151294]  print_report+0x10d/0x5d0
[   57.151304]  ? __virt_addr_valid+0x21d/0x3f0
[   57.151314]  ? cdev_put.part.0+0x3d/0x40
[   57.151320]  kasan_report+0x96/0xd0
[   57.151328]  ? cdev_put.part.0+0x3d/0x40
[   57.151335]  cdev_put.part.0+0x3d/0x40
[   57.151340]  __fput+0x7bc/0xa70
[   57.151350]  fput_close_sync+0xd8/0x190
[   57.151356]  ? __pfx_fput_close_sync+0x10/0x10
[   57.151365]  __x64_sys_close+0x79/0xd0
[   57.151373]  do_syscall_64+0x117/0x6b0
[   57.151381]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   57.151389] RIP: 0033:0x7f2f5a57b727
[   57.151395] Code: 48 89 fa 4c 89 df e8 28 ad 00 00 8b 93 08 03 00
00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24
10 0f 05 <5b> c3 0f 1f 80 00 0f
[   57.151400] RSP: 002b:00007ffdeb622670 EFLAGS: 00000202 ORIG_RAX:
0000000000000003
[   57.151407] RAX: ffffffffffffffda RBX: 00007f2f5a4eb780 RCX: 
00007f2f5a57b727
[   57.151411] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 
0000000000000003
[   57.151414] RBP: 00007ffdeb622700 R08: 0000000000000000 R09: 
0000000000000000
[   57.151417] R10: 0000000000000000 R11: 0000000000000202 R12: 
0000000000000000
[   57.151420] R13: 00007ffdeb622830 R14: 00007f2f5a71b000 R15: 
0000561d17af3d78
[   57.151428]  </TASK>
[   57.151431]
[   57.171652] Allocated by task 82:
[   57.171880]  kasan_save_stack+0x24/0x50
[   57.172142]  kasan_save_track+0x14/0x30
[   57.172400]  __kasan_kmalloc+0x7f/0x90
[   57.172650]  __kmalloc_cache_node_noprof+0x24b/0x5d0
[   57.172977]  nvme_alloc_ns+0xf8/0x3170
[   57.173231]  nvme_scan_ns+0x508/0x880
[   57.173477]  async_run_entry_fn+0x8c/0x350
[   57.173762]  process_scheduled_works+0xb6f/0x1a00
[   57.174073]  worker_thread+0x4ad/0xb40
[   57.174325]  kthread+0x34f/0x450
[   57.174542]  ret_from_fork+0x563/0x800
[   57.174791]  ret_from_fork_asm+0x1a/0x30
[   57.175053]
[   57.175165] Freed by task 230:
[   57.175369]  kasan_save_stack+0x24/0x50
[   57.175624]  kasan_save_track+0x14/0x30
[   57.175875]  kasan_save_free_info+0x3a/0x60
[   57.176151]  __kasan_slab_free+0x43/0x70
[   57.176412]  kfree+0x321/0x500
[   57.176616]  nvme_ns_chr_release+0x36/0x50
[   57.176885]  __fput+0x352/0xa70
[   57.177096]  fput_close_sync+0xd8/0x190
[   57.177349]  __x64_sys_close+0x79/0xd0
[   57.177596]  do_syscall_64+0x117/0x6b0
[   57.177845]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   57.178180]
[   57.178287] The buggy address belongs to the object at ffff888105cee000
[   57.178287]  which belongs to the cache kmalloc-2k of size 2048
[   57.179071] The buggy address is located 176 bytes inside of
[   57.179071]  freed 2048-byte region [ffff888105cee000, ffff888105cee800)
[   57.179864]
[   57.179970] The buggy address belongs to the physical page:
[   57.180332] page: refcount:0 mapcount:0 mapping:0000000000000000
index:0x0 pfn:0x105ce8
[   57.180848] head: order:3 mapcount:0 entire_mapcount:0
nr_pages_mapped:0 pincount:0
[   57.181338] flags: 0x200000000000040(head|node=0|zone=2)
[   57.181699] page_type: f5(slab)
[   57.181909] raw: 0200000000000040 ffff888100042f00 dead000000000100
dead000000000122
[   57.182402] raw: 0000000000000000 0000000000080008 00000000f5000000
0000000000000000
[   57.182893] head: 0200000000000040 ffff888100042f00
dead000000000100 dead000000000122
[   57.183399] head: 0000000000000000 0000000000080008
00000000f5000000 0000000000000000
[   57.183900] head: 0200000000000003 fffffffffffffe01
00000000ffffffff 00000000ffffffff
[   57.184410] head: 0000000000000000 0000000000000000
00000000ffffffff 0000000000000000
[   57.184906] page dumped because: kasan: bad access detected
[   57.185271]
[   57.185380] Memory state around the buggy address:
[   57.185698]  ffff888105cedf80: fc fc fc fc fc fc fc fc fc fc fc fc
fc fc fc fc
[   57.186171]  ffff888105cee000: fa fb fb fb fb fb fb fb fb fb fb fb
fb fb fb fb
[   57.186631] >ffff888105cee080: fb fb fb fb fb fb fb fb fb fb fb fb
fb fb fb fb
[   57.187201]                                      ^
[   57.187512]  ffff888105cee100: fb fb fb fb fb fb fb fb fb fb fb fb
fb fb fb fb
[   57.187980]  ffff888105cee180: fb fb fb fb fb fb fb fb fb fb fb fb
fb fb fb fb
[   57.188447] 
==================================================================
[   57.189823] Disabling lock debugging due to kernel taint