]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
nvme-apple: drop invalid put of admin queue reference count
authorFedor Pchelkin <pchelkin@ispras.ru>
Wed, 8 Apr 2026 14:18:14 +0000 (17:18 +0300)
committerKeith Busch <kbusch@kernel.org>
Thu, 16 Apr 2026 22:05:06 +0000 (15:05 -0700)
commitba9d308ccd6732dd97ed8080d834a4a89e758e14
treeaaa39edc26863c4662c15598c66d604ac7d6f0a1
parente80e39f25567310c1c7392eed886890b5c6788ba
nvme-apple: drop invalid put of admin queue reference count

Commit 03b3bcd319b3 ("nvme: fix admin request_queue lifetime") moved the
admin queue reference ->put call into nvme_free_ctrl() - a controller
device release callback performed for every nvme driver doing
nvme_init_ctrl().

nvme-apple sets refcount of the admin queue to 1 at allocation during the
probe function and then puts it twice now:

nvme_free_ctrl()
  blk_put_queue(ctrl->admin_q) // #1
  ->free_ctrl()
    apple_nvme_free_ctrl()
      blk_put_queue(anv->ctrl.admin_q) // #2

Note that there is a commit 941f7298c70c ("nvme-apple: remove an extra
queue reference") which intended to drop taking an extra admin queue
reference.  Looks like at that moment it accidentally fixed a refcount
leak, which existed since the driver's introduction.  There were two ->get
calls at driver's probe function and a single ->put inside
apple_nvme_free_ctrl().

However now after commit 03b3bcd319b3 ("nvme: fix admin request_queue
lifetime") the refcount is imbalanced again.  Fix it by removing extra
->put call from apple_nvme_free_ctrl().  anv->dev and ctrl->dev point to
the same device, so use ctrl->dev directly for simplification.  Compile
tested only.

Found by Linux Verification Center (linuxtesting.org).

Fixes: 03b3bcd319b3 ("nvme: fix admin request_queue lifetime")
Cc: stable@vger.kernel.org
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Signed-off-by: Keith Busch <kbusch@kernel.org>
drivers/nvme/host/apple.c