Hi,

This series addresses two race conditions in the nvmet core code that
handles I/O submission and namespace configuration.

The first patch addresses a race where target namespace attributes
could be changed while I/O is in progress. The second patch addresses
a subtle race that could allow I/O to be admitted even after the
percpu reference count has been killed or marked dead.

As usual, feedback, comments, and suggestions are most welcome!

Thanks!

Changes from v1:
  - Replace the XArray mark used to determine whether I/O should be
    admitted with an atomic bit. Using an XArray mark would touch
    significantly more cache lines in the I/O hot path than a simple
    bit test (hch)
  - Introduce the NVMET_NS_IO_LIVE namespace flag to address the cache
    line overhead of using an XArray mark.

Nilay Shroff (2):
  nvmet: defer setting ns->enabled to false in nvmet_ns_disable()
  nvmet: don't allow I/O admission after percpu ns reference is killed

 drivers/nvme/target/core.c  | 28 ++++++++++++++++++----------
 drivers/nvme/target/nvmet.h |  2 ++
 2 files changed, 20 insertions(+), 10 deletions(-)

-- 
2.53.0

On Fri, Sep 18, 2026 at 09:57:29PM +0530, Nilay Shroff wrote:
> Hi,
> 
> This series addresses two race conditions in the nvmet core code that
> handles I/O submission and namespace configuration.
> 
> The first patch addresses a race where target namespace attributes
> could be changed while I/O is in progress. The second patch addresses
> a subtle race that could allow I/O to be admitted even after the
> percpu reference count has been killed or marked dead.

Thanks, series applied to nvme-7.4.

On Tue, Sep 22, 2026 at 08:59:54AM -0600, Keith Busch wrote:
> Thanks, series applied to nvme-7.4.

Err, I mean 7.3 for this one since these are fixes.