[PATCH] nvme: fix crash and memory leak during invalid cdev teardown

[Maurizio Lombardi]

On Mon Jun 15, 2026 at 9:56 AM CEST, Daniel Wagner wrote:
>>  static int nvme_add_ns_head_cdev(struct nvme_ns_head *head)
>>  {
>>  	int ret;
>> +	char *name;
>>  
>>  	head->cdev_device.parent = &head->subsys->dev;
>> -	ret = dev_set_name(&head->cdev_device, "ng%dn%d",
>> -			   head->subsys->instance, head->instance);
>> -	if (ret)
>> -		return ret;
>> -	ret = nvme_cdev_add(&head->cdev, &head->cdev_device,
>> +	name = kasprintf(GFP_KERNEL, "ng%dn%d", head->subsys->instance,
>> +			 head->instance);
>> +	if (!name)
>> +		return -ENOMEM;
>> +
>> +	ret = nvme_cdev_add(name, &head->cdev, &head->cdev_device,
>>  			    &nvme_ns_head_chr_fops, THIS_MODULE);
>> +	if (ret)
>> +		dev_err(disk_to_dev(head->disk),
>> +			"Unable to create the %s device", name);
>> +	else
>> +		set_bit(NVME_NSHEAD_CDEV_LIVE, &head->flags);
>> +
>> +	kfree(name);
>>  	return ret;
>>  }
>
> nvme_add_ns_head_cdev returns the error code but nvme_mpath_set_live
> handle the return code. So we either don't need to return the error code
> or we should do something in nvme_mpath_set_live with it.

Please refer to the latest nvme-7.2 branch.
Those functions were later modified to not return error codes.

Maurizio