FAILED: patch "[PATCH] nvmet-auth: Synchronize timeout work during SQ teardown" failed to apply to 6.12-stable tree
Subsystems (3)
[email protected]
maintainerThe patch below does not apply to the 6.12-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.12.y
git checkout FETCH_HEAD
git cherry-pick -x eaa948c0e19b1bb2d93262207bca0c3d19cc3406
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026090904-flagstick-wrongdoer-b9ae@gregkh' --subject-prefix 'PATCH 6.12.y' 'HEAD^..'
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From eaa948c0e19b1bb2d93262207bca0c3d19cc3406 Mon Sep 17 00:00:00 2001
From: Kazuki Hanai <[email protected]>
Date: Sun, 30 Aug 2026 22:11:05 +0900
Subject: [PATCH] nvmet-auth: Synchronize timeout work during SQ teardown
nvmet_auth_sq_free() cancels auth_expired_work with cancel_delayed_work(). If the work has already started, cancellation does not wait for the callback. Transport teardown can consequently free or reuse the queue containing struct nvmet_sq while nvmet_auth_expired_work() still accesses that SQ.
Add a teardown-specific helper that synchronously drains the delayed work before freeing authentication state, and use it from nvmet_sq_destroy(). Keep the non-synchronous helper for in-band authentication state cleanup, where the SQ owner remains alive.
drivers/nvme/target/auth.c +6 -0
@@ -238,6 +238,12 @@ void nvmet_auth_sq_free(struct nvmet_sq *sq) sq->dhchap_skey =NULL ; } +void nvmet_auth_sq_destroy (struct nvmet_sq *sq) +{ +cancel_delayed_work_sync (&sq->auth_expired_work); +nvmet_auth_sq_free (sq); +} +void nvmet_destroy_auth (struct nvmet_ctrl *ctrl) { ctrl->shash_id =0 ;
drivers/nvme/target/core.c +1 -1
@@ -980,7 +980,7 @@ void nvmet_sq_destroy(struct nvmet_sq *sq)wait_for_completion (&sq->confirm_done);wait_for_completion (&sq->free_done);percpu_ref_exit (&sq->ref); -nvmet_auth_sq_free (sq); +nvmet_auth_sq_destroy (sq);nvmet_cq_put (sq->cq);/*
drivers/nvme/target/nvmet.h +2 -0
@@ -924,6 +924,7 @@ u8 nvmet_setup_auth(struct nvmet_ctrl *ctrl, struct nvmet_sq *sq, bool reset);void nvmet_auth_sq_init (struct nvmet_sq *sq);void nvmet_destroy_auth (struct nvmet_ctrl *ctrl);void nvmet_auth_sq_free (struct nvmet_sq *sq); +void nvmet_auth_sq_destroy (struct nvmet_sq *sq);int nvmet_setup_dhgroup (struct nvmet_ctrl *ctrl,u8 dhgroup_id);bool nvmet_check_auth_status (struct nvmet_req *req); int nvmet_auth_host_hash(struct nvmet_req *req, u8 *response,
@@ -950,6 +951,7 @@ static inline void nvmet_auth_sq_init(struct nvmet_sq *sq) }static inline void nvmet_destroy_auth (struct nvmet_ctrl *ctrl) {};static inline void nvmet_auth_sq_free (struct nvmet_sq *sq) {}; +static inline void nvmet_auth_sq_destroy (struct nvmet_sq *sq) {};static inline bool nvmet_check_auth_status (struct nvmet_req *req) {return true;
PATCH 1/1 nvmet-auth: Synchronize timeout work during SQ teardown
nvmet_auth_sq_free() cancels auth_expired_work with cancel_delayed_work(). If the work has already started, cancellation does not wait for the callback. Transport teardown can consequently free or reuse the queue containing struct nvmet_sq while nvmet_auth_expired_work() still accesses that SQ.
Add a teardown-specific helper that synchronously drains the delayed work before freeing authentication state, and use it from nvmet_sq_destroy(). Keep the non-synchronous helper for in-band authentication state cleanup, where the SQ owner remains alive.
--- drivers/nvme/target/auth.c | 6 ++++++ drivers/nvme/target/core.c | 2 +- drivers/nvme/target/nvmet.h | 2 ++ 3 files changed, 9 insertions(+), 1 deletion(-)
drivers/nvme/target/auth.c +6 -0
@@ -241,6 +241,12 @@ void nvmet_auth_sq_free(struct nvmet_sq *sq) sq->dhchap_skey =NULL ; } +void nvmet_auth_sq_destroy (struct nvmet_sq *sq) +{ +cancel_delayed_work_sync (&sq->auth_expired_work); +nvmet_auth_sq_free (sq); +} +void nvmet_destroy_auth (struct nvmet_ctrl *ctrl) { ctrl->shash_id =0 ;
drivers/nvme/target/core.c +1 -1
@@ -812,7 +812,7 @@ void nvmet_sq_destroy(struct nvmet_sq *sq)wait_for_completion (&sq->confirm_done);wait_for_completion (&sq->free_done);percpu_ref_exit (&sq->ref); -nvmet_auth_sq_free (sq); +nvmet_auth_sq_destroy (sq);/* * we must reference the ctrl again after waiting for inflight IO
drivers/nvme/target/nvmet.h +2 -0
@@ -737,6 +737,7 @@ u8 nvmet_setup_auth(struct nvmet_ctrl *ctrl);void nvmet_auth_sq_init (struct nvmet_sq *sq);void nvmet_destroy_auth (struct nvmet_ctrl *ctrl);void nvmet_auth_sq_free (struct nvmet_sq *sq); +void nvmet_auth_sq_destroy (struct nvmet_sq *sq);int nvmet_setup_dhgroup (struct nvmet_ctrl *ctrl,u8 dhgroup_id);bool nvmet_check_auth_status (struct nvmet_req *req); int nvmet_auth_host_hash(struct nvmet_req *req, u8 *response,
@@ -761,6 +762,7 @@ static inline void nvmet_auth_sq_init(struct nvmet_sq *sq) }static inline void nvmet_destroy_auth (struct nvmet_ctrl *ctrl) {};static inline void nvmet_auth_sq_free (struct nvmet_sq *sq) {}; +static inline void nvmet_auth_sq_destroy (struct nvmet_sq *sq) {};static inline bool nvmet_check_auth_status (struct nvmet_req *req) {return true;
Signature · 1 line
2.53.0
Re: [PATCH 6.12.y] nvmet-auth: Synchronize timeout work during SQ teardown
Quoted 5 lines
nvmet_auth_sq_free()cancelsauth_expired_workwithcancel_delayed_work(). If the work has already started, cancellation does not wait for the callback. Transport teardown can consequently free or reuse the queue containing structnvmet_sqwhilenvmet_auth_expired_work()still accesses that SQ.
Queued for 6.12, thanks.
Signature · 2 lines
Thanks, Sasha