Question: NVMe AER completion delivery during controller removal

[zhang san]

Hello,

We are seeking clarification about asynchronous event request (AER)
completion behavior during NVMe controller removal, before treating an
observed test failure as a production-reachable driver bug.

Our source analysis suggests a possible lifetime race between the AEN
completion path, which can requeue nvme_async_event_work, and the
controller removal path. We observed KASAN use-after-free in an
emulated environment on Linux v7.4-rc1 (6628e7d4c6b2).

However, our test induced an ERROR AEN through an out-of-specification
MMIO doorbell write while the device was being removed. This
deliberately synthetic trigger does not establish that a compliant
controller would generate the same completion.

Our main question is: can a specification-compliant controller deliver
a completion for a previously submitted AER during the interval in
which the host is disabling the controller and tearing down the admin
queue, or must such completions be quiesced before disable completes?
We would also welcome guidance on the exact point after which the host
may safely assume that no further AER completions can be delivered.

If a compliant device can generate a completion in the relevant
window, we can follow up with the source-level race analysis, complete
KASAN traces, and test details. Otherwise, we will not characterize
the synthetic result as a production-reachable UAF.

If a standards-compliant trigger or fix is identified, please CC me on
the relevant patch. I can help validate the reproduction conditions
and test the exact proposed change, providing a Tested-by tag if
verification succeeds.

The investigation used AI-assisted source analysis and experiments
reviewed by us.

Best regards
Yanhan Li