diff options
| author | Guixin Liu <kanie@linux.alibaba.com> | 2026-07-29 18:58:46 +0800 |
|---|---|---|
| committer | Keith Busch <kbusch@kernel.org> | 2026-07-29 08:08:01 -0700 |
| commit | f49d0c3a8d56a7cda1628ae17341a4a42063563c (patch) | |
| tree | 89afccbc87e7d08ff0cc5a6683ab9f0d3d9a4f54 /drivers/nvme/host | |
| parent | 581d8bb556dd3e5567bcf322aa5e3e4b6a200c08 (diff) | |
nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request
__nvme_fc_init_request() maps cmd_iu and then rsp_iu for DMA. If the
rsp_iu mapping fails, the original code only recorded the error and fell
through: it left the already-mapped cmd_iu unmapped and still marked the
op as FCPOP_STATE_IDLE before returning. Since blk-mq does not call
.exit_request() when .init_request() fails, the cmd_iu mapping is leaked
for every op whose rsp_iu mapping fails.
Jump to an error path on rsp_iu mapping failure that unmaps cmd_iu and
returns the error without marking the op idle, so it stays in the
FCPOP_STATE_UNINIT state set by the initial memset().
Fixes: e399441de911 ("nvme-fabrics: Add host support for FC transport")
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Diffstat (limited to 'drivers/nvme/host')
| -rw-r--r-- | drivers/nvme/host/fc.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c index 04363b9c4489..40f9da2833ff 100644 --- a/drivers/nvme/host/fc.c +++ b/drivers/nvme/host/fc.c @@ -2100,9 +2100,15 @@ __nvme_fc_init_request(struct nvme_fc_ctrl *ctrl, dev_err(ctrl->dev, "FCP Op failed - rspiu dma mapping failed.\n"); ret = -EFAULT; + goto out_unmap; } atomic_set(&op->state, FCPOP_STATE_IDLE); + return 0; + +out_unmap: + fc_dma_unmap_single(ctrl->lport->dev, op->fcp_req.cmddma, + sizeof(op->cmd_iu), DMA_TO_DEVICE); out_on_error: return ret; } |