[PATCH v3] nvme: fix command effects log lifetime for multipath heads

[Keith Busch]

On Tue, Sep 22, 2026 at 03:37:30PM +0800, Yao Sang wrote:
> KASAN reported a use-after-free when an I/O passthrough command was sent
> through a multipath namespace head after the controller path that first
> created the head had been removed:
> 
>   BUG: KASAN: slab-use-after-free in nvme_command_effects+0x192/0x200 [nvme_core]
>   Read of size 4 at addr ffff888141b14400 by task nvme/19811
>   nvme_command_effects+0x192/0x200 [nvme_core]
>   nvme_cmd_allowed+0x7e/0x1b0 [nvme_core]
>   nvme_user_cmd.constprop.0+0x1b5/0x450 [nvme_core]
>   nvme_ns_head_chr_ioctl+0xf4/0x2a0 [nvme_core]
> 
> Move the log cache to the subsystem, with one entry per command set. Both
> controllers and namespace heads hold subsystem references, keeping their
> log pointers valid until subsystem release.

Thanks, applied to nvme-7.3.