[PATCH v2] nvmet-tcp: fix a hang on queue teardown with data digest

[Shivam Kumar]

On Sat, Sep 12, 2026 at 1:39 AM Shivam Kumar
<kumar.shivam43666 at gmail.com> wrote:
>
> A command that has received all its data but whose data digest is still
> outstanding is stalled in NVMET_TCP_RECV_DDGST, where
> nvmet_tcp_need_data_in() is false. nvmet_tcp_uninit_data_in_cmds()
> therefore skips it during teardown, leaking its submission queue
> reference, and nvmet_sq_destroy() then blocks forever waiting on it.
>
> Release such a command in nvmet_tcp_uninit_data_in_cmds(), and reset
> rcv_state after that call.
>
> Fixes: 872d26a391da ("nvmet-tcp: add NVMe over TCP target driver")
> Cc: stable at vger.kernel.org
> Signed-off-by: Shivam Kumar <kumar.shivam43666 at gmail.com>
> ---
>  drivers/nvme/target/tcp.c | 10 ++++++++--
>  1 file changed, 8 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
> index e59810175262..3bf344b184e8 100644
> --- a/drivers/nvme/target/tcp.c
> +++ b/drivers/nvme/target/tcp.c
> @@ -1608,6 +1608,11 @@ static void nvmet_tcp_uninit_data_in_cmds(struct nvmet_tcp_queue *queue)
>                         nvmet_req_uninit(&cmd->req);
>         }
>
> +       if (queue->rcv_state == NVMET_TCP_RECV_DDGST && queue->cmd &&
> +           !nvmet_tcp_need_data_in(queue->cmd) &&
> +           !(queue->cmd->flags & NVMET_TCP_F_INIT_FAILED))
> +               nvmet_req_uninit(&queue->cmd->req);
> +
>         if (!queue->nr_cmds && nvmet_tcp_need_data_in(&queue->connect)) {
>                 /* failed in connect */
>                 nvmet_req_uninit(&queue->connect.req);
> @@ -1636,11 +1641,12 @@ static void nvmet_tcp_release_queue_work(struct work_struct *w)
>         nvmet_tcp_restore_socket_callbacks(queue);
>         cancel_delayed_work_sync(&queue->tls_handshake_tmo_work);
>         cancel_work_sync(&queue->io_work);
> -       /* stop accepting incoming data */
> -       queue->rcv_state = NVMET_TCP_RECV_ERR;
>
>         nvmet_sq_put_tls_key(&queue->nvme_sq);
>         nvmet_tcp_uninit_data_in_cmds(queue);
> +       /* stop accepting incoming data */
> +       queue->rcv_state = NVMET_TCP_RECV_ERR;
> +
>         nvmet_sq_destroy(&queue->nvme_sq);
>         nvmet_cq_put(&queue->nvme_cq);
>         cancel_work_sync(&queue->io_work);
> --
> 2.53.0
>
Gentle ping on this one.