[PATCH 0/2] nvmet: fix Reservation Acquire preempt sent by the holder

[Keith Busch]

On Fri, Oct 02, 2026 at 03:59:31PM +0900, Daejun Park wrote:
> nvmet_pr_preempt() does not follow NVMe Base Specification 2.1, section
> 8.1.22.7 when a Reservation Acquire command with the Preempt or Preempt
> and Abort action is sent by the reservation holder and the reservation
> is not of an All Registrants type.
> 
> Patch 1 fixes a use-after-free read in the path that handles a preempt
> sent by the holder.  It does not depend on patch 2 and comes first so
> that it can be backported alone.
> 
> Patch 2: a holder that preempts with the key of another registrant gets
> a successful completion, but that registrant stays registered and the
> reservation type is changed to RTYPE.  The pNFS SCSI layout server
> fences clients with this command (RFC 9561 section 2.2.3), so on an
> nvmet namespace nfsd logs a client as fenced while the client can still
> write to the device.  The patch lists what changes for a host that
> holds the reservation.

Thanks, applied to nvme-7.4.