Root Cause Analysis

1. Functions, Structs, and Files Involved

• drivers/nvme/target/configfs.c:
  • nvmet_addr_trtype_store(): Configfs .store callback for /config/nvmet/ports/<id>/addr_trtype.
  • nvmet_is_port_enabled(): Helper that checks p->enabled to prevent modifying port attributes while the port is enabled.
  • nvmet_port_subsys_allow_link(): Creates a symlink between a subsystem and a port; calls nvmet_enable_port() if the port's subsystems list is empty.
  • nvmet_port_subsys_drop_link(): Removes the symlink; calls nvmet_disable_port() when the subsystems list becomes empty.
• drivers/nvme/target/core.c:
  • nvmet_enable_port(): Enables a port using ops = nvmet_transports[port->disc_addr.trtype], calls ops->add_port(port), and at the end sets port->enabled = true and port->tr_ops = ops.
  • nvmet_disable_port(): Disables a port, but looks up ops = nvmet_transports[port->disc_addr.trtype] instead of using port->tr_ops.
• drivers/nvme/target/tcp.c:
  • nvmet_tcp_add_port(): Allocates and initializes struct nvmet_tcp_port, sets port->sock, and assigns nport->priv = port.
• drivers/nvme/target/fc.c:
  • nvmet_fc_remove_port(): Expects port->priv to be struct nvmet_fc_port_entry *pe and calls nvmet_fc_portentry_unbind(pe).
  • nvmet_fc_portentry_unbind(): Calls nvmet_fc_tgtport_put(pe->tgtport), sets pe->tgtport->pe = NULL, and performs list_del(&pe->pe_list).

2. Root Cause & Trigger Mechanism

1. When linking a subsystem to a port via configfs (nvmet_port_subsys_allow_link()), the semaphore nvmet_config_sem is acquired and nvmet_enable_port(port) is invoked.
2. In nvmet_enable_port(), ops is looked up from nvmet_transports[port->disc_addr.trtype] (here, TCP). Then ops->add_port(port) (nvmet_tcp_add_port()) is executed. Inside nvmet_tcp_add_port(), a struct nvmet_tcp_port is allocated and assigned to port->priv.
3. Note that port->enabled is only set to true at the very end of nvmet_enable_port(), after ops->add_port(port) completes.
4. Meanwhile, port attribute .store handlers in drivers/nvme/target/configfs.c (such as nvmet_addr_trtype_store()) do not acquire nvmet_config_sem and rely solely on nvmet_is_port_enabled(port) (which tests port->enabled).
5. A concurrent write to addr_trtype (e.g. writing "fc\n") races with nvmet_enable_port(), sees port->enabled == false, and mutates port->disc_addr.trtype to NVMF_TRTYPE_FC.
6. When the port is later disabled via nvmet_port_subsys_drop_link() -> nvmet_disable_port(), nvmet_disable_port() does not use port->tr_ops (which was saved as TCP), but instead retrieves the transport operations using ops = nvmet_transports[port->disc_addr.trtype]. Since port->disc_addr.trtype was changed to NVMF_TRTYPE_FC, it invokes nvmet_fc_remove_port().
7. nvmet_fc_remove_port() casts port->priv to struct nvmet_fc_port_entry *pe, leading to severe type confusion:
   • At offset 0 in struct nvmet_fc_port_entry, pe->tgtport is read. In struct nvmet_tcp_port, offset 0 contains sock (struct socket *).
   • nvmet_fc_portentry_unbind(pe) calls nvmet_fc_tgtport_put(pe->tgtport), which calls kref_put(&tgtport->ref, ...) on the memory inside the struct socket structure at the offset of tgtport->ref. Because that value is not a valid kref, refcount underflow is triggered.
   • It also executes pe->tgtport->pe = NULL (writing NULL into struct socket) and list_del(&pe->pe_list) (operating on pointers at offset 32 of struct nvmet_tcp_port, inside its accept_work structure).
   • Finally, kfree(pe) frees the struct nvmet_tcp_port directly without proper TCP socket cleanup.

3. Production Runtime Consequences & Schema Values

• MemoryCorruption (true): Type confusion causes invalid pointer writes (pe->tgtport->pe = NULL), linked list corruption (list_del), memory corruption within the socket object, and invalid/use-after-free conditions (kfree(pe) freeing a live struct nvmet_tcp_port).
• InfoLeak (none): The bug corrupts memory and crashes the kernel during teardown; no uninitialized or out-of-bounds kernel memory is copied or exposed to userspace.
• RawDenialOfService (true): In a production kernel without debug sanitizers, writing through wild pointers and performing list_del on arbitrary data results in kernel panics, page faults on non-canonical/invalid addresses, or severe data/socket structure corruption.
• IsNetCandidate (true): The bug directly involves the NVMe-oF TCP transport subsystem, socket allocation, and listening port setup (sock_create, kernel_bind, kernel_listen).
• IsKVMCandidate (false): No hypervisor, KVM, or virtualization interfaces are involved.