[PATCH v2] nvmet-tcp: fix a hang on queue teardown with data digest

[Shivam Kumar]

On Mon, Sep 21, 2026 at 1:06 PM Shivam Kumar
<kumar.shivam43666 at gmail.com> wrote:
>
> On Sat, Sep 12, 2026 at 1:39 AM Shivam Kumar
> <kumar.shivam43666 at gmail.com> wrote:
> >
> > A command that has received all its data but whose data digest is still
> > outstanding is stalled in NVMET_TCP_RECV_DDGST, where
> > nvmet_tcp_need_data_in() is false. nvmet_tcp_uninit_data_in_cmds()
> > therefore skips it during teardown, leaking its submission queue
> > reference, and nvmet_sq_destroy() then blocks forever waiting on it.
> >
> > Release such a command in nvmet_tcp_uninit_data_in_cmds(), and reset
> > rcv_state after that call.
> >
> > Fixes: 872d26a391da ("nvmet-tcp: add NVMe over TCP target driver")
> > Cc: stable at vger.kernel.org
> > Signed-off-by: Shivam Kumar <kumar.shivam43666 at gmail.com>
> > ---
> >  drivers/nvme/target/tcp.c | 10 ++++++++--
> >  1 file changed, 8 insertions(+), 2 deletions(-)
> >
> > diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
> > index e59810175262..3bf344b184e8 100644
> > --- a/drivers/nvme/target/tcp.c
> > +++ b/drivers/nvme/target/tcp.c
> > @@ -1608,6 +1608,11 @@ static void nvmet_tcp_uninit_data_in_cmds(struct nvmet_tcp_queue *queue)
> >                         nvmet_req_uninit(&cmd->req);
> >         }
> >
> > +       if (queue->rcv_state == NVMET_TCP_RECV_DDGST && queue->cmd &&
> > +           !nvmet_tcp_need_data_in(queue->cmd) &&
> > +           !(queue->cmd->flags & NVMET_TCP_F_INIT_FAILED))
> > +               nvmet_req_uninit(&queue->cmd->req);
> > +
> >         if (!queue->nr_cmds && nvmet_tcp_need_data_in(&queue->connect)) {
> >                 /* failed in connect */
> >                 nvmet_req_uninit(&queue->connect.req);
> > @@ -1636,11 +1641,12 @@ static void nvmet_tcp_release_queue_work(struct work_struct *w)
> >         nvmet_tcp_restore_socket_callbacks(queue);
> >         cancel_delayed_work_sync(&queue->tls_handshake_tmo_work);
> >         cancel_work_sync(&queue->io_work);
> > -       /* stop accepting incoming data */
> > -       queue->rcv_state = NVMET_TCP_RECV_ERR;
> >
> >         nvmet_sq_put_tls_key(&queue->nvme_sq);
> >         nvmet_tcp_uninit_data_in_cmds(queue);
> > +       /* stop accepting incoming data */
> > +       queue->rcv_state = NVMET_TCP_RECV_ERR;
> > +
> >         nvmet_sq_destroy(&queue->nvme_sq);
> >         nvmet_cq_put(&queue->nvme_cq);
> >         cancel_work_sync(&queue->io_work);
> > --
> > 2.53.0
> >
> Gentle ping on this one.
Gentle ping.