[PATCH v2] nvme: Do not drop the cdev reference twice when cdev_device_add() fails

[Keith Busch]

On Mon, Nov 02, 2026 at 05:50:15PM +0800, Yuqiang Sun wrote:
> Since commit 9952f3882ecb ("nvme: fix cdev lifetime"),
> nvme_add_ns_cdev() and nvme_add_ns_head_cdev() take a reference to the
> namespace (or namespace head) before calling nvme_cdev_add(), to be
> dropped by the char device's release, nvme_cdev_rel(), and drop it
> themselves when nvme_cdev_add() fails. But when cdev_device_add()
> fails, nvme_cdev_add() has already put the device, and nvme_cdev_rel()
> has already dropped that reference: the caller drops it a second time.
> 
> With one allocation failure injected into cdev_device_add() for a
> namespace on an NVMe over loop controller, deleting the controller
> gives, with native multipath:
> 
>   BUG: KASAN: slab-use-after-free in nvme_put_ns_head+0x21/0x140
>   Write of size 4 at addr ff1100000a4ea078 by task init/1
>    nvme_put_ns_head
>    nvme_put_ns
>    nvme_remove_namespaces
>    nvme_do_delete_ctrl
>    nvme_delete_ctrl_sync
>    nvme_sysfs_delete
>   Freed by task 1:
>    kfree
>    nvme_ns_remove
>    nvme_remove_namespaces
>   refcount_t: underflow; use-after-free.
> 
> Take the reference in nvme_cdev_add() instead, right before
> cdev_device_add(), and let the callers neither take nor drop it. Add
> nvme_is_ns_cdev() for the check that nvme_cdev_rel() and nvme_cdev_add()
> now share.

Thanks, applied to nvme-7.4.