Patch "nvme: move stopping keep-alive into nvme_uninit_ctrl()" has been added to the 6.10-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    nvme: move stopping keep-alive into nvme_uninit_ctrl()

to the 6.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     nvme-move-stopping-keep-alive-into-nvme_uninit_ctrl.patch
and it can be found in the queue-6.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 3a46b5b6dc39543d8eb658cd339e1853725c31d3
Author: Ming Lei <ming.lei@xxxxxxxxxx>
Date:   Tue Aug 13 09:35:27 2024 +0800

    nvme: move stopping keep-alive into nvme_uninit_ctrl()
    
    [ Upstream commit a54a93d0e3599b05856971734e15418ac551a14c ]
    
    Commit 4733b65d82bd ("nvme: start keep-alive after admin queue setup")
    moves starting keep-alive from nvme_start_ctrl() into
    nvme_init_ctrl_finish(), but don't move stopping keep-alive into
    nvme_uninit_ctrl(), so keep-alive work can be started and keep pending
    after failing to start controller, finally use-after-free is triggered if
    nvme host driver is unloaded.
    
    This patch fixes kernel panic when running nvme/004 in case that connection
    failure is triggered, by moving stopping keep-alive into nvme_uninit_ctrl().
    
    This way is reasonable because keep-alive is now started in
    nvme_init_ctrl_finish().
    
    Fixes: 3af755a46881 ("nvme: move nvme_stop_keep_alive() back to original position")
    Cc: Hannes Reinecke <hare@xxxxxxx>
    Cc: Mark O'Donovan <shiftee@xxxxxxxxxx>
    Reported-by: Changhui Zhong <czhong@xxxxxxxxxx>
    Reviewed-by: Christoph Hellwig <hch@xxxxxx>
    Reviewed-by: Sagi Grimberg <sagi@xxxxxxxxxxx>
    Reviewed-by: Hannes Reinecke <hare@xxxxxxx>
    Signed-off-by: Ming Lei <ming.lei@xxxxxxxxxx>
    Signed-off-by: Keith Busch <kbusch@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 782090ce0bc10..d973d063bbf50 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -4522,7 +4522,6 @@ void nvme_stop_ctrl(struct nvme_ctrl *ctrl)
 {
 	nvme_mpath_stop(ctrl);
 	nvme_auth_stop(ctrl);
-	nvme_stop_keep_alive(ctrl);
 	nvme_stop_failfast_work(ctrl);
 	flush_work(&ctrl->async_event_work);
 	cancel_work_sync(&ctrl->fw_act_work);
@@ -4558,6 +4557,7 @@ EXPORT_SYMBOL_GPL(nvme_start_ctrl);
 
 void nvme_uninit_ctrl(struct nvme_ctrl *ctrl)
 {
+	nvme_stop_keep_alive(ctrl);
 	nvme_hwmon_exit(ctrl);
 	nvme_fault_inject_fini(&ctrl->fault_inject);
 	dev_pm_qos_hide_latency_tolerance(ctrl->device);