From nobody Tue Sep 29 02:33:47 2026 Received: from mailgw.kylinos.cn (mailgw.kylinos.cn [124.126.103.232]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 23B7542F718 for ; Thu, 13 Aug 2026 07:16:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=124.126.103.232 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786605397; cv=none; b=tgQlKheBTKmwV2SuQomRFqCDiH9tmelCu9iAmtNa7sduJuy9qLw2rUKKrxv69ZLM1OfWrxnaOHB7mfnSgcm42kbMh2W0GDjBF7fhLABrzLUWfcawuGIg6FeGlO7L3bem7a1QAw6vBgOMRbHrM1B49CeyYhNxNrDpTYboSRrBSN0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786605397; c=relaxed/simple; bh=pIrg5ODQLpmShpd6OygHBgrWtsREzCxaWpRi1t20cfg=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=H43Yyuxsne/gJcboYsW1mUIrQuBDsqJbSJ5vjgcXz37O6LVZAiOJmxP1HI4SrbQiPxRhrpSqLLPVgZGVjDKAwtKPZWIFOYD+ml41wif3eKkuC2bGGQLvQUlun6VTOxR4jCQey7sRTp38UgjnnKnyJHFUeSjyUeEkAW/rb+7Glmo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn; spf=pass smtp.mailfrom=kylinos.cn; arc=none smtp.client-ip=124.126.103.232 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=kylinos.cn X-UUID: e35b901096e611f1aa26b74ffac11d73-20260813 X-CTIC-Tags: HR_CC_COUNT, HR_CC_DOMAIN_COUNT, HR_CC_NO_NAME, HR_CTE_8B, HR_CTT_TXT HR_DATE_H, HR_DATE_WKD, HR_DATE_ZONE, HR_FROM_NAME, HR_SJ_LANG HR_SJ_LEN, HR_SJ_LETTER, HR_SJ_NOR_SYM, HR_SJ_PHRASE, HR_SJ_PHRASE_LEN HR_SJ_WS, HR_TO_COUNT, HR_TO_DOMAIN_COUNT, HR_TO_NO_NAME, IP_UNTRUSTED SRC_UNTRUSTED, IP_UNFAMILIAR, SRC_UNFAMILIAR, DN_TRUSTED, SRC_TRUSTED SA_UNTRUSTED, SA_UNFAMILIAR, SN_UNTRUSTED, SN_UNFAMILIAR, SPF_NOPASS DKIM_NOPASS, DMARC_NOPASS, CIE_GOOD_SPF, CIE_UNKNOWN, GTI_FG_BS GTI_RG_INFO, GTI_C_BU, AMN_GOOD, ABX_MISS_RDNS X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.3.12,REQID:9ef97314-f75b-4a55-90fc-c394ae00e88c,IP:10, URL:0,TC:0,Content:0,EDM:0,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTION :release,TS:10 X-CID-INFO: VERSION:1.3.12,REQID:9ef97314-f75b-4a55-90fc-c394ae00e88c,IP:10,UR L:0,TC:0,Content:0,EDM:0,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTION:r elease,TS:10 X-CID-META: VersionHash:e7bac3a,CLOUDID:166c79d5bd959a94ac7d243c0e46d992,BulkI D:260813151627D4SSDGPS,BulkQuantity:0,Recheck:0,SF:10|66|78|102|127|136|86 5|898,TC:nil,Content:0|15|50,EDM:-3|-100,IP:-2,URL:0,File:nil,RT:nil,Bulk: nil,QS:nil,BEC:nil,COL:0,OSI:0,OSA:0,AV:0,LES:1,SPR:NO,DKR:0,DKP:0,BRR:0,B RE:0,ARC:0 X-CID-BVR: 2,SSN|SDN X-CID-BAS: 2,SSN|SDN,0,_ X-CID-FACTOR: TF_CID_SPAM_SNR X-CID-RHF: D41D8CD98F00B204E9800998ECF8427E X-UUID: e35b901096e611f1aa26b74ffac11d73-20260813 X-User: liuxixin@kylinos.cn Received: from [127.0.1.1] [(36.112.176.146)] by mailgw.kylinos.cn (envelope-from ) (Generic MTA with TLSv1.3 TLS_AES_256_GCM_SHA384 256/256) with ESMTP id 1358199554; Thu, 13 Aug 2026 15:16:22 +0800 From: Xixin Liu To: linux-nvme@lists.infradead.org Cc: hch@lst.de, sagi@grimberg.me, kch@nvidia.com, linux-kernel@vger.kernel.org, liuxixin@kylinos.cn Subject: [PATCH] nvmet-rdma: fix queue leak when connect backlog is exceeded Date: Thu, 13 Aug 2026 14:42:01 +0800 Message-ID: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Mailer: patches/scripts/send-local.py Content-Type: text/plain; charset="utf-8" When pending disconnecting queues exceed the backlog limit, the connect path only drops the device reference and leaks the newly allocated queue and its IB resources. Fixes: badc53620fe8 ("nvme: target: rdma: fix ndev refcount leak on queue c= onnect") Signed-off-by: Xixin Liu Reviewed-by: Christoph Hellwig --- drivers/nvme/target/rdma.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c index bdd28ce99..6273d26cd 100644 --- a/drivers/nvme/target/rdma.c +++ b/drivers/nvme/target/rdma.c @@ -1606,19 +1606,13 @@ static int nvmet_rdma_queue_connect(struct rdma_cm_= id *cm_id, mutex_unlock(&nvmet_rdma_queue_mutex); if (pending > NVMET_RDMA_BACKLOG) { ret =3D NVME_SC_CONNECT_CTRL_BUSY; - goto put_device; + goto free_queue; } } =20 ret =3D nvmet_rdma_cm_accept(cm_id, queue, &event->param.conn); - if (ret) { - /* - * Don't destroy the cm_id in free path, as we implicitly - * destroy the cm_id here with non-zero ret code. - */ - queue->cm_id =3D NULL; + if (ret) goto free_queue; - } =20 mutex_lock(&nvmet_rdma_queue_mutex); list_add_tail(&queue->queue_list, &nvmet_rdma_queue_list); @@ -1627,6 +1621,11 @@ static int nvmet_rdma_queue_connect(struct rdma_cm_i= d *cm_id, return 0; =20 free_queue: + /* + * Don't destroy the cm_id in free path, as we implicitly + * destroy the cm_id here with non-zero ret code. + */ + queue->cm_id =3D NULL; nvmet_rdma_free_queue(queue); put_device: kref_put(&ndev->ref, nvmet_rdma_free_dev); --=20 2.53.0