[PATCH v2] nvmet-fc: skip port entry rebinding if already bound to a target port

[PATCH v2] nvmet-fc: skip port entry rebinding if already bound to a target port

[Nguyen Duy Nhat Anh]

In nvmet_fc_portentry_rebind_tgt(), nvmet_fc_tgtlock serializes access to
nvmet_fc_portentry_list, but does not prevent multiple concurrent or
duplicate target port registrations from attempting to rebind to an
already-assigned port entry.

When pe->tgtport is non-NULL, WARN_ON() is triggered and pe->tgtport is
overwritten, leading to kernel warnings and leaking the reference count
acquired by nvmet_fc_tgtport_get().

Fix this by checking if pe->tgtport is already set before acquiring a
reference count and rebinding. If it is bound, skip the entry to prevent
clobbering existing bindings.

Reported-by: syzbot+be62d4b375542ecebd17@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=be62d4b375542ecebd17
Signed-off-by: Nguyen Duy Nhat Anh <neganhat@gmail.com>

---
v1 -> v2:
- Move pe->tgtport check before nvmet_fc_tgtport_get() to avoid refcount leak.
---
 drivers/nvme/target/fc.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
index 1b557775e033..9b7fd8f5bd47 100644
--- a/drivers/nvme/target/fc.c
+++ b/drivers/nvme/target/fc.c
@@ -1324,7 +1324,9 @@ nvmet_fc_portentry_rebind_tgt(struct nvmet_fc_tgtport *tgtport)
 			if (!nvmet_fc_tgtport_get(tgtport))
 				continue;
 
-			WARN_ON(pe->tgtport);
+			if (pe->tgtport)
+				continue;
+
 			tgtport->pe = pe;
 			pe->tgtport = tgtport;
 			break;
-- 
2.55.0

Re: [PATCH v2] nvmet-fc: skip port entry rebinding if already bound to a target port

[Keith Busch]

On Fri, Oct 16, 2026 at 10:59:47PM +0700, Nguyen Duy Nhat Anh wrote:
> v1 -> v2:
> - Move pe->tgtport check before nvmet_fc_tgtport_get() to avoid refcount leak.

You may want to double check before posting new versions because this v2
is identical to v1.

Re: [PATCH v2] nvmet-fc: skip port entry rebinding if already bound to a target port

[Nhật Anh Nguyễn Duy]

Sorry about the noise in the recent patches—I botched staging the diff
before amending. v3 has the actual diff moving the check above
nvmet_fc_tgtport_get().

Regards,
Nhat Anh

On Fri, Oct 16, 2026 at 11:06 PM Keith Busch <kbusch@kernel.org> wrote:
>
> On Fri, Oct 16, 2026 at 10:59:47PM +0700, Nguyen Duy Nhat Anh wrote:
> > v1 -> v2:
> > - Move pe->tgtport check before nvmet_fc_tgtport_get() to avoid refcount leak.
>
> You may want to double check before posting new versions because this v2
> is identical to v1.