6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Guixin Liu [ Upstream commit 18fc5f6f1ca945630dae5404265de55d65194e22 ] nvmet_bdev_execute_rw() starts a plug before building the bios, but the two error exits taken when nvmet_bdev_alloc_bip() fails return without calling blk_finish_plug(). current->plug is left pointing at the stack frame of the returned function, so the next blk_flush_plug() walks a stale list. Route both failures through a common exit that finishes the plug. Fixes: c6e3f13398123 ("nvmet: add metadata support for block devices") Cc: stable@vger.kernel.org Reviewed-by: Hannes Reinecke Reviewed-by: Christoph Hellwig Reviewed-by: Nilay Shroff Signed-off-by: Guixin Liu Signed-off-by: Keith Busch Signed-off-by: Sasha Levin --- drivers/nvme/target/io-cmd-bdev.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/nvme/target/io-cmd-bdev.c b/drivers/nvme/target/io-cmd-bdev.c index 0103815542d49..160364cc8c980 100644 --- a/drivers/nvme/target/io-cmd-bdev.c +++ b/drivers/nvme/target/io-cmd-bdev.c @@ -305,7 +305,7 @@ static void nvmet_bdev_execute_rw(struct nvmet_req *req) &prot_miter); if (unlikely(rc)) { bio_io_error(bio); - return; + goto out_plug; } } @@ -325,11 +325,12 @@ static void nvmet_bdev_execute_rw(struct nvmet_req *req) rc = nvmet_bdev_alloc_bip(req, bio, &prot_miter); if (unlikely(rc)) { bio_io_error(bio); - return; + goto out_plug; } } submit_bio(bio); +out_plug: blk_finish_plug(&plug); } -- 2.53.0