[PATCH] nvmet: use the local P2P device on metadata allocation failure

[Sang-Hoon Choi]

nvmet_req_alloc_p2pmem_sgls() assigns req->p2p_dev only after the data
and metadata SGL allocations succeed. If the data allocation succeeds
but the metadata allocation fails, out_free_sg passes req->p2p_dev to
pci_p2pmem_free_sgl() before that assignment has taken place.

Pass the local p2p_dev argument instead, so cleanup uses the same PCI
device as the successful data allocation.

Fixes: bcd9a0797d73 ("nvmet: fix freeing unallocated p2pmem")
Reported-by: Changyul Lee <lcy8047 at gmail.com>
Link: https://github.com/lcy8047/radix-tree-bug-temp/blob/main/bug_list/idr-ida-xarray/missing-idr-lock/IDR-BUG-90-nvmet-p2p-ns-map-lookup.md
Assisted-by: Sang-Hoon Choi <csh0052 at gmail.com>
Signed-off-by: Sang-Hoon Choi <csh0052 at gmail.com>
---
Compile-tested on x86_64 with allmodconfig and W=1 against mainline
6f8319e3e9a44dd537d17f41565a8453c560a581. No P2P hardware or metadata
allocation failure test was performed.

 drivers/nvme/target/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
index 43871a8f56ca..9ef29b2b49de 100644
--- a/drivers/nvme/target/core.c
+++ b/drivers/nvme/target/core.c
@@ -1317,7 +1317,7 @@ static int nvmet_req_alloc_p2pmem_sgls(struct pci_dev *p2p_dev,
 
 	return 0;
 out_free_sg:
-	pci_p2pmem_free_sgl(req->p2p_dev, req->sg);
+	pci_p2pmem_free_sgl(p2p_dev, req->sg);
 out_err:
 	return -ENOMEM;
 }
-- 
2.43.0