From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CB2C53264FF for ; Tue, 11 Aug 2026 15:29:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786462181; cv=none; b=T0fJ9ouLaM36GpxugwVMu/svF0zBxFVQEVyb0nagu+CNj3kW9PLgfNK9AWXOXf3CwpLy5LwmCxRatS+WymCBnhwc0bJvuYc+oTYkQ/yKXPX19jM2td2/3IeA2waxUEoDDp6zUVBze+m0MWDEan+/EV3FTFSzU8W2hghtCc0eMPw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786462181; c=relaxed/simple; bh=UxhByiOCHq2lrCAczdD7tSGzQ++sAlaaKiByOIhLzaY=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=pqqiB2ZReMRW+r1CD21JUBFOZ4lByE/jNH+LIwPBhv9PgHukYpySbRZTo4XVbIryuqv/rVG+b7mzwJRXISQNFwtHBBILKKQpHdSRnOQQcB8ptEPESa8afK2988ZQeslz8pfSWbeG1IXq/kR5Wsruf5ZHWLbd+smbUgqmlQCtye0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=WMqrtZma; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="WMqrtZma" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1BE3F1F000E9; Tue, 11 Aug 2026 15:29:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1786462180; bh=9mYHGQ2Q+YL+7Y+umND8aH8Znn1uhq2HGqzgJMKW+7g=; h=Date:From:To:Cc:Subject:References:In-Reply-To; b=WMqrtZmaHZaL1+UdVsFI7tW8p58TgGA7yDsW+dotxkiR6ZeOdnv67Hi/htEiZh5Mt 6oBvKZRQO9GwMJrLgjt9Ku0MXmbkUhtg9Ihj6xZ9S8uKqJpAnH1L6lGQqoObDEpSKv bJovCo0WVqId7bbPqoYgpzmJU17CK1C0ehfXKCj4XJzV9/Luniig5aFeBo7oMZnPgE 56gudfAR60tjMACaShgNmRq/pnbNO9zZf8dQ+iCSnZ47fNzoP0UCy5cHZR8099gXQX z1HF73j72BxthFfFpAmLieIKSQEJLohuR3yVUouDTGXfr6CJH0lET2aH4xBpvM/tGX gv+1S2WyKXlgA== Date: Tue, 11 Aug 2026 09:29:38 -0600 From: Keith Busch To: Rihyeon Kim Cc: hch@lst.de, sagi@grimberg.me, axboe@kernel.dk, justin.tee@broadcom.com, nareshgottumukkala83@gmail.com, paul.ely@broadcom.com, kch@nvidia.com, linux-nvme@lists.infradead.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails Message-ID: References: <6a7a83ac.01d0871a.3a0d52.00bb.GAE@google.com> <20260811125310.165487-1-rihyeon8648@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260811125310.165487-1-rihyeon8648@gmail.com> On Tue, Aug 11, 2026 at 09:53:10PM +0900, Rihyeon Kim wrote: > It only does so on the fail_ctrl: path, though. When nvme_add_ctrl() > fails, nvme_fc_init_ctrl() jumps to out_put_ctrl: instead, so > nvme_fc_ctrl_free() still sees ctrl->ctrl.opts set and frees opts, and > nvmf_create_ctrl() frees it again. ... > diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c > index 04363b9c4489..e4d0eeccd846 100644 > --- a/drivers/nvme/host/fc.c > +++ b/drivers/nvme/host/fc.c > @@ -3601,6 +3601,9 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts, > nvme_uninit_ctrl(&ctrl->ctrl); > > out_put_ctrl: > + /* nvme_add_ctrl() failures skip the clear in fail_ctrl: above */ > + ctrl->ctrl.opts = NULL; > + > /* Remove core ctrl ref. */ > nvme_put_ctrl(&ctrl->ctrl); Can't you move the setting from the "fail_ctrl:" label to the "out_put_ctrl:" one instead of duplicating it for both?