From 2b646788ee24d895b8862514e12a95ce5d72d6cc Mon Sep 17 00:00:00 2001 From: Chris Mason Date: Wed, 28 Oct 2026 10:42:31 -0600 Subject: [PATCH] nvmet-rdma: flush nvmet-wq on module exit nvmet_rdma_exit() relies on ib_unregister_client() to flush nvmet-wq through nvmet_rdma_remove_one(), but since commit a3dd7d0022c3 that returns at once for a device no longer on device_list. The release work of the last queue takes the device off the list in nvmet_rdma_free_dev() and still has to drop the mutex, free the struct and return through nvmet_rdma_release_queue_work(), so an rmmod in that window frees the module code it's running. Flush nvmet-wq after ib_unregister_client(). No release work can be queued after that point. Fixes: a3dd7d0022c3 ("nvmet-rdma: Don't flush system_wq by default during remove_one") Cc: Christoph Hellwig Cc: Sagi Grimberg Cc: Chaitanya Kulkarni Signed-off-by: Chris Mason Signed-off-by: Jens Axboe Signed-off-by: Keith Busch --- drivers/nvme/target/rdma.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c index ebf4a7bde524..ed11263ea93f 100644 --- a/drivers/nvme/target/rdma.c +++ b/drivers/nvme/target/rdma.c @@ -2151,6 +2151,12 @@ static void __exit nvmet_rdma_exit(void) { nvmet_unregister_transport(&nvmet_rdma_ops); ib_unregister_client(&nvmet_rdma_ib_client); + /* + * nvmet_rdma_remove_one() does not flush for a device that has left + * device_list, and the release work that took it off still has to + * return from nvmet_rdma_free_dev(). + */ + flush_workqueue(nvmet_wq); WARN_ON_ONCE(!list_empty(&nvmet_rdma_queue_list)); ida_destroy(&nvmet_rdma_queue_ida); }