[PATCH] nvmet: use the local P2P device on metadata allocation failure

[Maurizio Lombardi]

On Wed Sep 30, 2026 at 9:08 AM CEST, Sang-Hoon Choi wrote:
> nvmet_req_alloc_p2pmem_sgls() assigns req->p2p_dev only after the data
> and metadata SGL allocations succeed. If the data allocation succeeds
> but the metadata allocation fails, out_free_sg passes req->p2p_dev to
> pci_p2pmem_free_sgl() before that assignment has taken place.
>
> Pass the local p2p_dev argument instead, so cleanup uses the same PCI
> device as the successful data allocation.
>
> Fixes: bcd9a0797d73 ("nvmet: fix freeing unallocated p2pmem")
> Reported-by: Changyul Lee <lcy8047 at gmail.com>
> Link: https://github.com/lcy8047/radix-tree-bug-temp/blob/main/bug_list/idr-ida-xarray/missing-idr-lock/IDR-BUG-90-nvmet-p2p-ns-map-lookup.md

This link gives 404 to me but anyway the patch looks ok

Reviewed-by: Maurizio Lombardi <mlombard at redhat.com>


> Assisted-by: Sang-Hoon Choi <csh0052 at gmail.com>
> Signed-off-by: Sang-Hoon Choi <csh0052 at gmail.com>
> ---
> Compile-tested on x86_64 with allmodconfig and W=1 against mainline
> 6f8319e3e9a44dd537d17f41565a8453c560a581. No P2P hardware or metadata
> allocation failure test was performed.
>
>  drivers/nvme/target/core.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
> index 43871a8f56ca..9ef29b2b49de 100644
> --- a/drivers/nvme/target/core.c
> +++ b/drivers/nvme/target/core.c
> @@ -1317,7 +1317,7 @@ static int nvmet_req_alloc_p2pmem_sgls(struct pci_dev *p2p_dev,
>  
>  	return 0;
>  out_free_sg:
> -	pci_p2pmem_free_sgl(req->p2p_dev, req->sg);
> +	pci_p2pmem_free_sgl(p2p_dev, req->sg);
>  out_err:
>  	return -ENOMEM;
>  }