In the Linux kernel, the following vulnerability has been resolved:

nvme-fc: Do not cancel requests in io target before it is initialized

A new nvme-fc controller in CONNECTING state sees admin request timeout schedules ctrl->ioerr work to abort inflight requests. This ends up calling nvme fc abort outstanding ios() which aborts requests in both admin and io tagsets. In case fc ctrl->tag set was not initialized we see the warning below. This is because ctrl.queue count is initialized early in nvme fc alloc ctrl().

nvme nvme0: NVME-FC{0}: starting error recovery Connectivity Loss INFO: trying to register non-static key. The code is fine but needs lockdep annotation, or maybe lpfc 0000:ab:00.0: queue 0 connect admin queue failed (-6). you didn't initialize this object before use? turning off the locking correctness validator. Workqueue: nvme-reset-wq nvme fc ctrl ioerr work [nvme fc] Call Trace: dump stack lvl+0x57/0x80 register lock class+0x567/0x580 lock acquire+0x330/0xb90 lock acquire.part.0+0xad/0x210 blk mq tagset busy iter+0xf9/0xc00 nvme fc abort outstanding ios+0x23f/0x320 [nvme fc] nvme fc ctrl ioerr work+0x172/0x210 [nvme fc] process one work+0x82c/0x1450 worker thread+0x5ee/0xfd0 kthread+0x3a0/0x750 ret from fork+0x439/0x670 ret from fork asm+0x1a/0x30

Update the check in nvme fc abort outstanding ios() confirm that io tagset was created before iterating over busy requests. Also make sure to cancel ctrl->ioerr work before removing io tagset.