[PATCH 14/19] nvmet-rdma: queue the release work under the mutex

[Christoph Hellwig]

On Thu, Oct 29, 2026 at 08:52:47AM -0700, Keith Busch wrote:
> From: Chris Mason <mason at kernel.org>
> 
> nvmet_rdma_remove_one() takes the queue mutex, unlists each queue of
> the device and queues its release work, then flushes nvmet-wq. So a
> queue that still holds objects on the device must either be on the
> list or have its release work queued. nvmet_rdma_queue_disconnect()
> breaks that: it unlists the queue under the mutex, drops it, and only
> then calls __nvmet_rdma_queue_disconnect() to queue the work. A device
> removal in that window finds nothing to wait for, and the release work
> then destroys the QP and CQ share on a freed device.
> 
> Queue the work before dropping the mutex, as nvmet_rdma_remove_one()
> itself does. That's safe now that rdma_disconnect() no longer sleeps on
> an iWARP event that needs the same mutex.
> 
> Fixes: f1d4ef7d8883 ("nvmet-rdma: register ib_client to not deadlock in device removal")
> Cc: Christoph Hellwig <hch at lst.de>
> Cc: Sagi Grimberg <sagi at grimberg.me>
> Cc: Chaitanya Kulkarni <kch at nvidia.com>
> Signed-off-by: Chris Mason <mason at kernel.org>
> Signed-off-by: Jens Axboe <axboe at kernel.dk>
> Signed-off-by: Keith Busch <kbusch at kernel.org>
> ---
>  drivers/nvme/target/rdma.c | 12 ++++++------
>  1 file changed, 6 insertions(+), 6 deletions(-)
> 
> diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c
> index fe91df653e5cf..35fd3f3c35dc1 100644
> --- a/drivers/nvme/target/rdma.c
> +++ b/drivers/nvme/target/rdma.c
> @@ -1744,17 +1744,17 @@ static void __nvmet_rdma_queue_disconnect(struct nvmet_rdma_queue *queue)
>  
>  static void nvmet_rdma_queue_disconnect(struct nvmet_rdma_queue *queue)
>  {
> -	bool disconnect = false;
> -
> +	/*
> +	 * The release work is queued with the mutex held, so that
> +	 * nvmet_rdma_remove_one() finds the queue on the list or its work on
> +	 * the workqueue.

Odd sentence structure once again:

	/*
	 * Queue the release work is with &nvmet_rdma_queue_mutex held, so that
	 * nvmet_rdma_remove_one() either finds the queue on the list or its
	 * the work has already been queued.
	 */

Otherwise looks good:

Reviewed-by: Christoph Hellwig <hch at lst.de>