Linux-NVME Archive on
 help / color / Atom feed
From: Edmund Nadolski <>
Subject: [PATCH] nvme: clear stale nvmeq->tags after tagset free
Date: Tue, 14 Jan 2020 11:17:45 -0700
Message-ID: <> (raw)

This patch introduces nvme_exit_hctx() to NULL the nvmeq->tags pointer
after a tagset free, so that a subsequent nvme_init_hctx() can
correctly re-initialize it.

This patch fixes a failure case which occurs during cascaded controller
resets. The tagset is freed after the controller fails commands which
try to create IO SQs. A second reset restores the controller, but the
following nvme_validate_ns/device_add_disk sequence uses the old/stale
nvmeq->tags value, leading to an invalid tag value in nvme_handle_cqe and
kernel panic from nvme_irq.

Signed-off-by: Edmund Nadolski <>
 drivers/nvme/host/pci.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 365a2ddbeaa7..7daf3888ba8e 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -404,6 +404,13 @@ static int nvme_init_hctx(struct blk_mq_hw_ctx *hctx, void *data,
 	return 0;
+static void nvme_exit_hctx(struct blk_mq_hw_ctx *hctx, unsigned int hctx_idx)
+	struct nvme_queue *nvmeq = hctx->driver_data;
+	nvmeq->tags = NULL;
 static int nvme_init_request(struct blk_mq_tag_set *set, struct request *req,
 		unsigned int hctx_idx, unsigned int numa_node)
@@ -1582,6 +1589,7 @@ static const struct blk_mq_ops nvme_mq_ops = {
 	.complete	= nvme_pci_complete_rq,
 	.commit_rqs	= nvme_commit_rqs,
 	.init_hctx	= nvme_init_hctx,
+	.exit_hctx      = nvme_exit_hctx,
 	.init_request	= nvme_init_request,
 	.map_queues	= nvme_pci_map_queues,
 	.timeout	= nvme_timeout,

linux-nvme mailing list

             reply index

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-01-14 18:17 Edmund Nadolski [this message]
2020-01-16 16:06 ` Keith Busch
2020-01-16 22:06   ` Nadolski, Edmund
2020-01-16 23:26     ` Keith Busch

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Linux-NVME Archive on

Archives are clonable:
	git clone --mirror linux-nvme/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-nvme linux-nvme/ \
	public-inbox-index linux-nvme

Example config snippet for mirrors

Newsgroup available over NNTP:

AGPL code for this site: git clone