[PATCH 0/2] nvmet: fix configfs attribute validation

[shao.mingyin]

This series fixes two independent configfs attribute bugs in nvmet.

Patch 1 fixes a use-after-free when attr_tbkas is written while a
controller is going away.  The store callback walked subsys->ctrls under
nvmet_config_sem only, while the list is protected by subsys->lock and
nvmet_ctrl_free() does not take nvmet_config_sem.  Take subsys->lock for
the walk, as the qid_max store callback already does.

Patch 2 fixes an off-by-one write in the traddr and trsvcid store
callbacks.  A write of exactly NVMF_TRADDR_SIZE or NVMF_TRSVCID_SIZE
characters was accepted, and the following sscanf("%s") had no field
width, so it wrote the value plus the trailing NUL one byte past the
destination array.  Bound the scans to the array size.

Both patches are independent and can be applied in any order.  Both
carry Fixes: and Cc: stable.

Testing: both apply to next-20261030, pass checkpatch.pl --strict with
0 errors/0 warnings/0 checks, and drivers/nvme/target/configfs.c builds
with CONFIG_NVME_TARGET=m and W=1 without new warnings.

Patch 1 was reproduced with a KASAN kernel: hammering attr_tbkas while
loop controllers were continuously connected and deleted crashed the
unpatched kernel with a general protection fault in
nvmet_subsys_attr_tbkas_store() (KASAN wild-memory-access at a poisoned
list pointer).  With the patch the same 60-second stress, about 39k
iterations of the store, completed without any report.

Patch 2 was also reproduced and re-tested in QEMU (7.3.0-next-20261030):
a 256-character addr_traddr write cleared tsas.rdma.qptype (addr_tsas
went from "connected" to empty) before the fix, and is truncated to 255
characters with TSAS intact after it.

Signed-off-by: Shao Mingyin <shao.mingyin@xxxxxxxxxx>
---
base-commit: 7649ba73f9e7e1e04d0b46213e39c79ae09dd55c