* [PATCH] nvmet-fc: skip port entry rebinding if already bound to a target port
@ 2026-10-16 15:54 Nguyen Duy Nhat Anh
0 siblings, 0 replies; 2+ messages in thread
From: Nguyen Duy Nhat Anh @ 2026-10-16 15:54 UTC (permalink / raw)
To: paul.ely
Cc: nareshgottumukkala83, hch, sagi, kch, linux-nvme, linux-kernel,
Nguyen Duy Nhat Anh, syzbot+be62d4b375542ecebd17
In nvmet_fc_portentry_rebind_tgt(), nvmet_fc_tgtlock serializes access to
nvmet_fc_portentry_list, but does not prevent multiple concurrent or
duplicate target port registrations from attempting to rebind to an
already-assigned port entry.
When pe->tgtport is non-NULL, WARN_ON() is triggered and pe->tgtport is
overwritten, leading to kernel warnings and leaking the reference count
acquired by nvmet_fc_tgtport_get().
Fix this by checking if pe->tgtport is already set before acquiring a
reference count and rebinding. If it is bound, skip the entry to prevent
clobbering existing bindings.
Reported-by: syzbot+be62d4b375542ecebd17@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=be62d4b375542ecebd17
Signed-off-by: Nguyen Duy Nhat Anh <neganhat@gmail.com>
---
drivers/nvme/target/fc.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
index 1b557775e033..9b7fd8f5bd47 100644
--- a/drivers/nvme/target/fc.c
+++ b/drivers/nvme/target/fc.c
@@ -1324,7 +1324,9 @@ nvmet_fc_portentry_rebind_tgt(struct nvmet_fc_tgtport *tgtport)
if (!nvmet_fc_tgtport_get(tgtport))
continue;
- WARN_ON(pe->tgtport);
+ if (pe->tgtport)
+ continue;
+
tgtport->pe = pe;
pe->tgtport = tgtport;
break;
--
2.55.0
^ permalink raw reply [flat|nested] 2+ messages in thread
* [PATCH] nvmet-fc: skip port entry rebinding if already bound to a target port
@ 2026-10-16 15:48 Nguyen Duy Nhat Anh
0 siblings, 0 replies; 2+ messages in thread
From: Nguyen Duy Nhat Anh @ 2026-10-16 15:48 UTC (permalink / raw)
To: justin.tee
Cc: nareshgottumukkala83, paul.ely, hch, sagi, kch, linux-nvme,
linux-kernel, Nguyen Duy Nhat Anh, syzbot+be62d4b375542ecebd17
In nvmet_fc_portentry_rebind_tgt(), nvmet_fc_tgtlock serializes access to
nvmet_fc_portentry_list, but does not prevent multiple concurrent or
duplicate target port registrations from attempting to rebind to an
already-assigned port entry.
When pe->tgtport is non-NULL, WARN_ON() is triggered and pe->tgtport is
overwritten, leading to kernel warnings and leaking the reference count
acquired by nvmet_fc_tgtport_get().
Fix this by checking if pe->tgtport is already set before acquiring a
reference count and rebinding. If it is bound, skip the entry to prevent
clobbering existing bindings.
Reported-by: syzbot+be62d4b375542ecebd17@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=be62d4b375542ecebd17
Signed-off-by: Nguyen Duy Nhat Anh <neganhat@gmail.com>
---
drivers/nvme/target/fc.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
index 1b557775e033..9b7fd8f5bd47 100644
--- a/drivers/nvme/target/fc.c
+++ b/drivers/nvme/target/fc.c
@@ -1324,7 +1324,9 @@ nvmet_fc_portentry_rebind_tgt(struct nvmet_fc_tgtport *tgtport)
if (!nvmet_fc_tgtport_get(tgtport))
continue;
- WARN_ON(pe->tgtport);
+ if (pe->tgtport)
+ continue;
+
tgtport->pe = pe;
pe->tgtport = tgtport;
break;
--
2.55.0
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-10-16 15:54 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-10-16 15:54 [PATCH] nvmet-fc: skip port entry rebinding if already bound to a target port Nguyen Duy Nhat Anh
-- strict thread matches above, loose matches on Subject: below --
2026-10-16 15:48 Nguyen Duy Nhat Anh
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®