[PATCH 2/2] nvmet-tcp: remove duplicate cancel_work_sync in release_queue_work

[Maurizio Lombardi]

On Tue May 19, 2026 at 8:10 AM CEST, Geliang Tang wrote:
> From: Geliang Tang <tanggeliang at kylinos.cn>
>
> The cancel_work_sync(&queue->io_work) is called twice in
> nvmet_tcp_release_queue_work(). Remove the second one as it is redundant.
>
> Fixes: a208fc5672177 ("nvmet-tcp: fix a race condition between release_queue and io_work")
> Signed-off-by: Geliang Tang <tanggeliang at kylinos.cn>
> ---
>  drivers/nvme/target/tcp.c | 1 -
>  1 file changed, 1 deletion(-)
>
> diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
> index 8a243d22a511..af7ce384b3cf 100644
> --- a/drivers/nvme/target/tcp.c
> +++ b/drivers/nvme/target/tcp.c
> @@ -1616,7 +1616,6 @@ static void nvmet_tcp_release_queue_work(struct work_struct *w)
>  	nvmet_tcp_uninit_data_in_cmds(queue);
>  	nvmet_sq_destroy(&queue->nvme_sq);
>  	nvmet_cq_put(&queue->nvme_cq);
> -	cancel_work_sync(&queue->io_work);
>  	nvmet_tcp_free_cmd_data_in_buffers(queue);
>  	/* ->sock will be released by fput() */
>  	fput(queue->sock->file);

I think that the second cancel_work_sync() is done because
nvmet_sq_destroy() can potentially end up calling
nvmet_req_complete()

nvmet_sq_destroy() -> nvmet_async_events_failall() ->
nvmet_req_complete() -> queue_response()

and this kicks a new io_work.

Maurizio