[PATCH v2 0/2] nvmet: fix subtle race in I/O processing and ns configuration

From: Nilay Shroff

Date: Fri Sep 18 2026 - 12:46:42 EST


Hi,

This series addresses two race conditions in the nvmet core code that
handles I/O submission and namespace configuration.

The first patch addresses a race where target namespace attributes
could be changed while I/O is in progress. The second patch addresses
a subtle race that could allow I/O to be admitted even after the
percpu reference count has been killed or marked dead.

As usual, feedback, comments, and suggestions are most welcome!

Thanks!

Changes from v1:
- Replace the XArray mark used to determine whether I/O should be
admitted with an atomic bit. Using an XArray mark would touch
significantly more cache lines in the I/O hot path than a simple
bit test (hch)
- Introduce the NVMET_NS_IO_LIVE namespace flag to address the cache
line overhead of using an XArray mark.

Nilay Shroff (2):
nvmet: defer setting ns->enabled to false in nvmet_ns_disable()
nvmet: don't allow I/O admission after percpu ns reference is killed

drivers/nvme/target/core.c | 28 ++++++++++++++++++----------
drivers/nvme/target/nvmet.h | 2 ++
2 files changed, 20 insertions(+), 10 deletions(-)

--
2.53.0