From ced363dcd3ef076e509bfbb4ce9815ebaff6aee7 Mon Sep 17 00:00:00 2001
From: Irvin Cote <irvin.cote@insa-lyon.fr>
Date: Wed, 8 Feb 2023 11:38:39 -0300
Subject: [PATCH] nvme-pci : rectifying the nvme_probe teardown path
The nvme_probe teardown path did not account for
undoing the work of nvme_pci_alloc_dev, which is
what nvme_pci_free_ctrl seemed to be intended for.
Thus I displaced the call to nvme_uninit_ctrl
from nvme_probe to nvme_pci_free_ctrl and added
a call to the latter in the teardown path of nvme_probe.

Fixes: eac3ef262941 ("nvme-pci: split the initial probe from the rest path")
Signed-off-by: Irvin Cote <irvin.cote@insa-lyon.fr>
---
 drivers/nvme/host/pci.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index c734934c407c..db480bc64c7b 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -2731,6 +2731,7 @@ static void nvme_pci_free_ctrl(struct nvme_ctrl *ctrl)
 	struct nvme_dev *dev = to_nvme_dev(ctrl);

 	nvme_free_tagset(dev);
+	nvme_uninit_ctrl(ctrl);
 	put_device(dev->dev);
 	kfree(dev->queues);
 	kfree(dev);
@@ -3036,7 +3037,7 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id)

 	result = nvme_dev_map(dev);
 	if (result)
-		goto out_uninit_ctrl;
+		goto out_unalloc_dev;

 	result = nvme_setup_prp_pools(dev);
 	if (result)
@@ -3118,8 +3119,8 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 	nvme_release_prp_pools(dev);
 out_dev_unmap:
 	nvme_dev_unmap(dev);
-out_uninit_ctrl:
-	nvme_uninit_ctrl(&dev->ctrl);
+out_unalloc_dev:
+	nvme_pci_free_ctrl(&dev->ctrl);
 	return result;
 }

--
2.37.2

On Wed, Feb 08, 2023 at 04:38:54PM +0100, Irvin Cote wrote:
> >From ced363dcd3ef076e509bfbb4ce9815ebaff6aee7 Mon Sep 17 00:00:00 2001
> From: Irvin Cote <irvin.cote@insa-lyon.fr>
> Date: Wed, 8 Feb 2023 11:38:39 -0300
> Subject: [PATCH] nvme-pci : rectifying the nvme_probe teardown path
> The nvme_probe teardown path did not account for
> undoing the work of nvme_pci_alloc_dev, which is
> what nvme_pci_free_ctrl seemed to be intended for.
> Thus I displaced the call to nvme_uninit_ctrl
> from nvme_probe to nvme_pci_free_ctrl and added
> a call to the latter in the teardown path of nvme_probe.

Can you explain the problems you are seeing?

> index c734934c407c..db480bc64c7b 100644
> --- a/drivers/nvme/host/pci.c
> +++ b/drivers/nvme/host/pci.c
> @@ -2731,6 +2731,7 @@ static void nvme_pci_free_ctrl(struct nvme_ctrl *ctrl)
>  	struct nvme_dev *dev = to_nvme_dev(ctrl);
> 
>  	nvme_free_tagset(dev);
> +	nvme_uninit_ctrl(ctrl);

->free_ctrl is called for the final put of the ctrl, calling
nvme_uninit_ctrl here does not make sense.

> -out_uninit_ctrl:
> -	nvme_uninit_ctrl(&dev->ctrl);
> +out_unalloc_dev:
> +	nvme_pci_free_ctrl(&dev->ctrl);

Also calling nvme_pci_free_ctrl directly and not through the method
table is also wrong.