]> git.ipfire.org Git - thirdparty/kernel/linux.git/commitdiff
nvme-apple: drop invalid put of admin queue reference count
authorFedor Pchelkin <pchelkin@ispras.ru>
Wed, 8 Apr 2026 14:18:14 +0000 (17:18 +0300)
committerKeith Busch <kbusch@kernel.org>
Thu, 16 Apr 2026 22:05:06 +0000 (15:05 -0700)
Commit 03b3bcd319b3 ("nvme: fix admin request_queue lifetime") moved the
admin queue reference ->put call into nvme_free_ctrl() - a controller
device release callback performed for every nvme driver doing
nvme_init_ctrl().

nvme-apple sets refcount of the admin queue to 1 at allocation during the
probe function and then puts it twice now:

nvme_free_ctrl()
  blk_put_queue(ctrl->admin_q) // #1
  ->free_ctrl()
    apple_nvme_free_ctrl()
      blk_put_queue(anv->ctrl.admin_q) // #2

Note that there is a commit 941f7298c70c ("nvme-apple: remove an extra
queue reference") which intended to drop taking an extra admin queue
reference.  Looks like at that moment it accidentally fixed a refcount
leak, which existed since the driver's introduction.  There were two ->get
calls at driver's probe function and a single ->put inside
apple_nvme_free_ctrl().

However now after commit 03b3bcd319b3 ("nvme: fix admin request_queue
lifetime") the refcount is imbalanced again.  Fix it by removing extra
->put call from apple_nvme_free_ctrl().  anv->dev and ctrl->dev point to
the same device, so use ctrl->dev directly for simplification.  Compile
tested only.

Found by Linux Verification Center (linuxtesting.org).

Fixes: 03b3bcd319b3 ("nvme: fix admin request_queue lifetime")
Cc: stable@vger.kernel.org
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Signed-off-by: Keith Busch <kbusch@kernel.org>
drivers/nvme/host/apple.c

index ed61b97fde59f7e02664798d9c2612ac16307f5c..423c9c628e7bfa769070aed3ca221c111c020678 100644 (file)
@@ -1267,11 +1267,7 @@ static int apple_nvme_get_address(struct nvme_ctrl *ctrl, char *buf, int size)
 
 static void apple_nvme_free_ctrl(struct nvme_ctrl *ctrl)
 {
-       struct apple_nvme *anv = ctrl_to_apple_nvme(ctrl);
-
-       if (anv->ctrl.admin_q)
-               blk_put_queue(anv->ctrl.admin_q);
-       put_device(anv->dev);
+       put_device(ctrl->dev);
 }
 
 static const struct nvme_ctrl_ops nvme_ctrl_ops = {