From nobody Fri Sep 25 04:07:46 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 63F6B4BF92A; Wed, 16 Sep 2026 23:09:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789600179; cv=none; b=LDqARdQLp9lSfjCVwhrdMBZYepL/hFuCMMHn7dnftkNkr+YjZwQhnFm01eoU9hrc9t2t+OC6jBgGRIHxhjpkv8taJPO22nIPvbdr0BzETEFmcEplnZ8yGaMUqHzIdKoIJE61j8z3PF33Pe8zBHPE68nyN8t8+0eWlp7MQpy8a7Y= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789600179; c=relaxed/simple; bh=zgxjKpn1kyNMIBVwaF12Kde+LXaxrhu50R6RDuOyIJY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=nMOcrzkT98To5T4sDpY3LvUj+EMf4W2G7J0RG0y37TxpgMF3nwxCpO6AB7bXCoioRu2tLsaFROP9DdApupS3ch771006Sr2Gro6e7/766DcSUxZPAoCG53A8j7Pbp0yFMsFujdnCfko+DdT0yprPIo3H/xGvDncEFb1SS9TBhYU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=OFhRkpOB; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="OFhRkpOB" Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68GG1m86018184; Wed, 16 Sep 2026 23:09:31 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=ClrGPMR2eCl1PGakK 33NKTydd8/M9xCYys0xvOiUDi8=; b=OFhRkpOBPfgJsJbxJWy67Aa92Frhw3uoE uXr0HoA6qMxsbLYBgcBSM+ekV2Qi2cJ5ZdzW9/sllmR1SvWdJBC3Lv8Awx9D5EI/ C/MuUaEpcz+aMiDQVsq/lGfCC1JRtKhPJyEQjrMXy93SRVuveNwjM7MICILlzbz8 biauDN9Wv7upWw4tYGwbwZF2Er140GzsapyHwobFc74IG21X3XOyMm9wQedIAc1V dA7i550bEvWNG8D13pWMIz6JsIcp+Rz9mJ+djguBNZV4EV8OY195ko+/rDolbX3M CXWnUKsF7440pwEz0k9MW0DXSBKArI+4Gn18Tn+mCflt8VzQUXg0Q== Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gmxf57dwv-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Wed, 16 Sep 2026 23:09:30 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 68GMxnNW1649291; Wed, 16 Sep 2026 23:09:29 GMT Received: from smtprelay07.dal12v.mail.ibm.com ([172.16.1.9]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4gq03c0une-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 16 Sep 2026 23:09:29 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay07.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 68GN9SGU59965792 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 16 Sep 2026 23:09:28 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 5DCC45804E; Wed, 16 Sep 2026 23:09:28 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 696E158056; Wed, 16 Sep 2026 23:09:27 +0000 (GMT) Received: from li-4c4c4544-0054-3910-8039-c3c04f423534.ibm.com.com (unknown [9.61.141.190]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 16 Sep 2026 23:09:27 +0000 (GMT) From: Tyrel Datwyler To: james.bottomley@hansenpartnership.com, martin.petersen@oracle.com Cc: linux-scsi@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, brking@linux.ibm.com, davemarq@linux.ibm.com, Tyrel Datwyler Subject: [PATCH 01/20] scsi: ibmvfc: initialize evt->tgt for NVMe FCP commands Date: Wed, 16 Sep 2026 16:09:02 -0700 Message-ID: <20260916230921.2204729-2-tyreld@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260916230921.2204729-1-tyreld@linux.ibm.com> References: <20260916230921.2204729-1-tyreld@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: _P-5uaKXzyGQGrPy7hqE-hW_xa2qQV9f X-Proofpoint-Spam-Info: AW1haW4tMjYwOTE2MDMyMiBTYWx0ZWRfX9pBpqj6SOcAd qFjI1h8NCr/IMSJzeZ/pjvbuQkVhdO5frGSOKRC1J6X2xPDWnH5+560eSfTV72+BvTIfNy5OHO+ xN+Q31bbfIBa0f5P9gFCxgdnyUwwVFk= X-Authority-Analysis: v=2.4 cv=cvgOAF4i c=1 sm=1 tr=0 ts=6aab21aa cx=c_pps a=5BHTudwdYE3Te8bg5FgnPg==:117 a=5BHTudwdYE3Te8bg5FgnPg==:17 a=VdqzKS8jKosA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=U7nrCbtTmkRpXpFmAIza:22 a=VnNF1IyMAAAA:8 a=24aaq1eNYdOIN5PvXmkA:9 X-Proofpoint-ORIG-GUID: _P-5uaKXzyGQGrPy7hqE-hW_xa2qQV9f X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTE2MDMyMiBTYWx0ZWRfX/cGUYNrN42bH t67rMcVJL/uWbsR6A0IB73P5sJYqz/Iv9jmj2DlhoicinHg7YqLKGvEZC+ASOkR6uhhOFkrMJD3 uX4wUbXpXLqzPd7DkoVm22IfyLelrHGgzXgQp7uOW7omCbNS1BIYF9Dvc350Y/ecyAXs8W2OAa0 u3BPYQRNx3dDbac0ZbKI6KF6iit7wHbcYY6owqFrAim5Uc2eldRHV/K4nCm1hmRa6wrqtfrSST7 3bRevoYv4tkW6zpItJhllzO+0cgBzJib9p0tZKVO6GL5sZUj6fb5dAEsXbs0VVJzsIumE/nQjpK uCUcua2VgXqktIMe0X4RvJGXMp5iML4Zd4ki3ifO/R14Wx6N/TRWOuya1/fVDo7V8GpIRt66IJ9 M4DZ/AnfQSMxVjrCElRyPIlmyrCwLauvNXGE3TVEPJ96OorHvIvM3rp1gvHr35Ur9o7IyNBUpcf /ZWtp14olIVLKuEOWWw== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-16_03,2026-09-16_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 lowpriorityscore=0 clxscore=1015 priorityscore=1501 suspectscore=0 bulkscore=0 impostorscore=0 phishscore=0 spamscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609160322 Content-Type: text/plain; charset="utf-8" ibmvfc_nvme_fcp_io() submits NVMe FCP requests without setting evt->tgt on the allocated event. ibmvfc_init_event() does not initialize this field, so it retains whatever value was left in the pool-allocated event structure. When an FCP request times out the NVMe-FC transport calls ibmvfc_nvme_fcp_abort(), which in turn calls ibmvfc_init_fcp_abort() to build the cancel MAD. That function derives the target pointer from abt_evt->tgt: struct ibmvfc_target *tgt =3D abt_evt->tgt; ... tmf->target_wwpn =3D cpu_to_be64(tgt->wwpn); tmf->assoc_id =3D cpu_to_be64(tgt->assoc_id); Because abt_evt->tgt was never initialized this is a guaranteed NULL or stale-pointer dereference on the first NVMe I/O timeout, resulting in a kernel panic. Fix this by assigning evt->tgt =3D rport->private immediately after ibmvfc_init_event(), consistent with how ibmvfc_nvme_ls_req() already sets evt->tgt for LS requests. This also has the benefit of making the associated remote port target visible on in-flight FCP events, which is useful for live debugging (e.g. reading tgt->wwpn from a hung command in a crash/kdump context). Fixes: 4e70b8795ee3 ("scsi: ibmvfc: implement nvme-fc FCP abort callback") Signed-off-by: Tyrel Datwyler --- drivers/scsi/ibmvscsi/ibmvfc-nvme.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/scsi/ibmvscsi/ibmvfc-nvme.c b/drivers/scsi/ibmvscsi/ib= mvfc-nvme.c index 9ac2671a3567..9ed6522c2e9e 100644 --- a/drivers/scsi/ibmvscsi/ibmvfc-nvme.c +++ b/drivers/scsi/ibmvscsi/ibmvfc-nvme.c @@ -359,6 +359,7 @@ static int ibmvfc_nvme_fcp_io(struct nvme_fc_local_port= *lport, ibmvfc_dbg(vhost, "vfc-nvme-mq-%d\n", evt->hwq); =20 ibmvfc_init_event(evt, ibmvfc_nvme_done, IBMVFC_CMD_FORMAT); + evt->tgt =3D rport->private; evt->fcp_req =3D fcp_req; fcp_req->private =3D evt; =20 --=20 2.55.0 From nobody Fri Sep 25 04:07:46 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3F5A335675E; Wed, 16 Sep 2026 23:09:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789600178; cv=none; b=E8UZRQkM9UTC4oMME8v5bvoRMAsQd9S79gtR+Aaw037ksvPjhbSbpn04sjJndbbQC3fpT+61alHbUPejreTedUAt8ZLCxxD6fS2B74K2wjtuGg3K5Po5RI9Tn8JpGAxFXAK4VRRwvbIZ+9pwakf4JTnigXoYAVNRImiRyHZJWvA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789600178; c=relaxed/simple; bh=Cha+I9NkfmaLktxuIn1xfXME2O+qYxsUpsi2Sl26Eaw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=OUceQwdmIjqNLY1XgKLqbmNSbslDZJJkSMzsJvQuOzH0eaYKFn5gOGa+jUd7VJzp6F5+RtFzZpLEFkjgl23FN4DK7BtTOXgfC4eaQ14doXAsE4cCqnFtwsJpN5cIliME8ZV69+kPfvV9ApM2rS7DsSUx3+v5w8SRP55OvGFgcSQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=ATxxqcSu; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="ATxxqcSu" Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68GG1QSL017615; Wed, 16 Sep 2026 23:09:31 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=z0kqp0MahhEkDHyt5 qR/Mq5RMXsM3Fgey5/W5u12EiI=; b=ATxxqcSuC4kcdQgziReRPTtANJga+cfSb j0tXUTcaltMCJGrdpt201oabiWtI5+FjhUEnlpiYTq/NoqVJtKGWsGeFtAHUPP+g 0nHa6K0JO8DmwJfe1McDVymt/cDR/7DBuImmR8XfM2JbqCTqrosARjorRdPKByz6 71SCg0L5/oQHfB6gp/8csas5D0coTOR4rbJURu+HUojv4SlpqHq79DEj26HLsj6h NJBynvl6LmN7UIC1qU2+VkvgGz/YP7ivHDx8qQDg1mtuwZjMvilUluYpqtUyPAW9 98+6jqMBR5FSnxxbQ4eamXfOWywdZjG5Qixj8B02PRWW8W41r2JZg== Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gmxf57dwx-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Wed, 16 Sep 2026 23:09:31 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 68GN2GYu1625352; Wed, 16 Sep 2026 23:09:30 GMT Received: from smtprelay01.wdc07v.mail.ibm.com ([172.16.1.68]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4gpyxsgw6g-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 16 Sep 2026 23:09:30 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay01.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 68GN9TbA51511670 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 16 Sep 2026 23:09:29 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 7A2295804E; Wed, 16 Sep 2026 23:09:29 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 8B23058064; Wed, 16 Sep 2026 23:09:28 +0000 (GMT) Received: from li-4c4c4544-0054-3910-8039-c3c04f423534.ibm.com.com (unknown [9.61.141.190]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 16 Sep 2026 23:09:28 +0000 (GMT) From: Tyrel Datwyler To: james.bottomley@hansenpartnership.com, martin.petersen@oracle.com Cc: linux-scsi@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, brking@linux.ibm.com, davemarq@linux.ibm.com, Tyrel Datwyler Subject: [PATCH 02/20] scsi: ibmvfc: fix trace logging for NVMe FCP commands Date: Wed, 16 Sep 2026 16:09:03 -0700 Message-ID: <20260916230921.2204729-3-tyreld@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260916230921.2204729-1-tyreld@linux.ibm.com> References: <20260916230921.2204729-1-tyreld@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: _QEA5SHzISShg65lVIvzQOiHDFn-qN-y X-Proofpoint-Spam-Info: AW1haW4tMjYwOTE2MDMyMiBTYWx0ZWRfX+PvITezOk+CN PhU/HXQ/xOwG/iLPk9lS+aaC+lfSkNC5V/BWOcNVmXbDE7CYrTNF7pu/nWz+xOD9pHq1JMLbW+2 5Yli9ocn2E0huHG8m0MLJK2d0LZpqkk= X-Authority-Analysis: v=2.4 cv=cvgOAF4i c=1 sm=1 tr=0 ts=6aab21ab cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=VdqzKS8jKosA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=U7nrCbtTmkRpXpFmAIza:22 a=VnNF1IyMAAAA:8 a=fF8LTD-R--w6NU_6X2kA:9 X-Proofpoint-ORIG-GUID: _QEA5SHzISShg65lVIvzQOiHDFn-qN-y X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTE2MDMyMiBTYWx0ZWRfX7FWvv7aX62hw RmUxI52OCzcl95qwxfq2QNoEai1Nhkt0vnglf6lXvIx5Xw+asV/s6VNm35ht4I+RGL1uWMf1+TY fgA9KlnLdM0vGQOg8rHNrda9VYJlnDpfzqrHVrSw3l7CP15ycSoP39GnqZxJaqw3/v1B88EEXqF oF5f96IkBECA6EaHTcZmTWX2fflDixtYMO/W1gv8tllv13xcpRNTMvotE6Eyo27KU7LCWbk32N0 flzZuhXX3yhj10qHZj25KvGQp+bAHtnC3RUmy0U48791Llm+lZJN0FyJRD+p/NkT7KcRKPiNlB8 aYh2VPI5qLAMcxtwZgmR3CFkJ4d0cpnGmVBLrHRWM6uhchEtriDlLCbzjJ0voZYWNJDrNqbb0zq 11XfUFiHWW5AM3XKnoXUUFxU5wW+KqpvBTUKPg7HFbkkzn5IclaOhVq7JFWsDKC1Lw5w/AP+/Yk H86Ai29yYAXTpEQnzGQ== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-16_03,2026-09-16_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 lowpriorityscore=0 clxscore=1015 priorityscore=1501 suspectscore=0 bulkscore=0 impostorscore=0 phishscore=0 spamscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609160322 Content-Type: text/plain; charset="utf-8" ibmvfc_trc_start() and ibmvfc_trc_end() handle IBMVFC_CMD_FORMAT events by reading SCSI-specific fields via ibmvfc_get_fcp_iu() and ibmvfc_get_fcp_rsp(). These helpers return a pointer into the v3scsi union member of struct ibmvfc_cmd, but NVMe FCP commands store their command IU in the v3nvme union member. Reading SCSI FCP fields out of an NVMe IU produces garbage trace entries (wrong opcode, lun, tmf_flags, xfer_len, rsp_code, and scsi_status). Fix this by gating the SCSI-specific field reads on evt->cmnd within the IBMVFC_CMD_FORMAT branch. For NVMe FCP events (evt->fcp_req set) record the NVMe SQE opcode from v3nvme.iu.sqe.common.opcode and the payload length from vfc_cmd->payload_len. The common fields that are valid for both protocols (tgt_scsi_id, vfc_cmd->status, vfc_cmd->error) are logged unconditionally. Fixes: 73c13e30c56f ("scsi: ibmvfc: implement nvme-fc IO command submission= callback") Signed-off-by: Tyrel Datwyler --- drivers/scsi/ibmvscsi/ibmvfc-core.c | 29 +++++++++++++++++++---------- 1 file changed, 19 insertions(+), 10 deletions(-) diff --git a/drivers/scsi/ibmvscsi/ibmvfc-core.c b/drivers/scsi/ibmvscsi/ib= mvfc-core.c index aa7ae81df41b..6c243b2a84d7 100644 --- a/drivers/scsi/ibmvscsi/ibmvfc-core.c +++ b/drivers/scsi/ibmvscsi/ibmvfc-core.c @@ -257,11 +257,16 @@ static void ibmvfc_trc_start(struct ibmvfc_event *evt) =20 switch (entry->fmt) { case IBMVFC_CMD_FORMAT: - entry->op_code =3D iu->cdb[0]; entry->scsi_id =3D be64_to_cpu(vfc_cmd->tgt_scsi_id); - entry->lun =3D scsilun_to_int(&iu->lun); - entry->tmf_flags =3D iu->tmf_flags; - entry->u.start.xfer_len =3D be32_to_cpu(iu->xfer_len); + if (evt->cmnd) { + entry->op_code =3D iu->cdb[0]; + entry->lun =3D scsilun_to_int(&iu->lun); + entry->tmf_flags =3D iu->tmf_flags; + entry->u.start.xfer_len =3D be32_to_cpu(iu->xfer_len); + } else if (evt->fcp_req) { + entry->op_code =3D vfc_cmd->v3nvme.iu.sqe.common.opcode; + entry->u.start.xfer_len =3D be32_to_cpu(vfc_cmd->payload_len); + } break; case IBMVFC_MAD_FORMAT: entry->op_code =3D be32_to_cpu(mad->opcode); @@ -294,15 +299,19 @@ static void ibmvfc_trc_end(struct ibmvfc_event *evt) =20 switch (entry->fmt) { case IBMVFC_CMD_FORMAT: - entry->op_code =3D iu->cdb[0]; entry->scsi_id =3D be64_to_cpu(vfc_cmd->tgt_scsi_id); - entry->lun =3D scsilun_to_int(&iu->lun); - entry->tmf_flags =3D iu->tmf_flags; entry->u.end.status =3D be16_to_cpu(vfc_cmd->status); entry->u.end.error =3D be16_to_cpu(vfc_cmd->error); - entry->u.end.fcp_rsp_flags =3D rsp->flags; - entry->u.end.rsp_code =3D rsp->data.info.rsp_code; - entry->u.end.scsi_status =3D rsp->scsi_status; + if (evt->cmnd) { + entry->op_code =3D iu->cdb[0]; + entry->lun =3D scsilun_to_int(&iu->lun); + entry->tmf_flags =3D iu->tmf_flags; + entry->u.end.fcp_rsp_flags =3D rsp->flags; + entry->u.end.rsp_code =3D rsp->data.info.rsp_code; + entry->u.end.scsi_status =3D rsp->scsi_status; + } else if (evt->fcp_req) { + entry->op_code =3D vfc_cmd->v3nvme.iu.sqe.common.opcode; + } break; case IBMVFC_MAD_FORMAT: entry->op_code =3D be32_to_cpu(mad->opcode); --=20 2.55.0 From nobody Fri Sep 25 04:07:46 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B40EB4DF4C1; Wed, 16 Sep 2026 23:09:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789600184; cv=none; b=A3vKZTu27bfLCihMroHz1odgDwYh7BV88CApjTEUm0wRinnto6v81Eqw2eFgDCsgzGgj/Q7EYLcxgo7Z/V+8ErYg+FZQ+BIuoiQsaqSqv+YaTFvqJUfc1dR8sdplZRWnhU2a+/oJaWgvOuQs8Dp/tqqiBfSCmH1Aau/QsLKii+g= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789600184; c=relaxed/simple; bh=6CaT59oRLZ3rFOT8vOw1RxJtmXbUP4inYSQFp3+tKhc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=cLKEgTBXUs88LUWtuaqzDyA2esacQ5gX7xJXmyQxAyZ46H/BH86BL6V3Z7o/FYmuYqbyCS9KoZuTm3RDNIb+ZvImYy9bNvmRxxPDVz1t//wV9MPUQ7nhaTqaSeVXIZYi+M1aoeUx3RGeQc7rHx7Ki9vjV3Q0ukvD9GasxWZsf8U= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=s5becn6m; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="s5becn6m" Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68GG1aj1045837; Wed, 16 Sep 2026 23:09:33 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=Xb1t6UG59AexkF0FB CbVFa0p2vpQQ6dGGidUk5u8CfA=; b=s5becn6mmZ9zLlhonXMWDvKlqBe+U5s/k bJSTx5L36h3lY9WuAAiGo+GsDkLXl6S1BZ/8Anha+UTJJwZZ2xNym4khpNlhIG0s wLXMaCW7ml8H3xOeXAjIuLfwOasbrmqxrhkh0Nj71vaASoFGEih/PV5PNlpWapnb i19SEVj3osQovVFGHBKg6+QyuivISpPQCl/HrZO3rxJ/d1ZTnxBuQjIAuynR9p94 CAu4JFFHJX9thgrE/KpWWVKD0jEtxIL5KXAhRWrSO2nEN4d5MdoV8fhzYKkHUbJP jDJVKIDUWeIi7J7Yvak6+veRWxKgd146B97IuGDI1810ppMaUp5uA== Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gmxcv6y0u-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Wed, 16 Sep 2026 23:09:32 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 68GMl8Sx1699706; Wed, 16 Sep 2026 23:09:32 GMT Received: from smtprelay02.wdc07v.mail.ibm.com ([172.16.1.69]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 4gq03vguf3-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 16 Sep 2026 23:09:32 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay02.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 68GN9Uff28246642 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 16 Sep 2026 23:09:30 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 9A46258054; Wed, 16 Sep 2026 23:09:30 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id A83C35804E; Wed, 16 Sep 2026 23:09:29 +0000 (GMT) Received: from li-4c4c4544-0054-3910-8039-c3c04f423534.ibm.com.com (unknown [9.61.141.190]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 16 Sep 2026 23:09:29 +0000 (GMT) From: Tyrel Datwyler To: james.bottomley@hansenpartnership.com, martin.petersen@oracle.com Cc: linux-scsi@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, brking@linux.ibm.com, davemarq@linux.ibm.com, Tyrel Datwyler Subject: [PATCH 03/20] scsi: ibmvfc: complete NVMe FCP requests on H_CLOSED send failure Date: Wed, 16 Sep 2026 16:09:04 -0700 Message-ID: <20260916230921.2204729-4-tyreld@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260916230921.2204729-1-tyreld@linux.ibm.com> References: <20260916230921.2204729-1-tyreld@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Info: AW1haW4tMjYwOTE2MDMyMiBTYWx0ZWRfXxJeBNGdwgnPt LmZaMZXizFRsEDdatJgXKbDeTpImrd7IdjCOf2pGyArm23Y+s6JiZoCp0oLqoZiS6ye99XSItLM b9HsC1amDgeTYSDEbvv/OTVsAITkc2U= X-Proofpoint-ORIG-GUID: 1or1IyOl_UzzAxE-ZeuXr5TjGiyrH_dY X-Proofpoint-GUID: 1or1IyOl_UzzAxE-ZeuXr5TjGiyrH_dY X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTE2MDMyMiBTYWx0ZWRfX1rRFGjQJS4ki fFMH+0YwllavOlr4L/L4WgkPS+qXXIA/2Rs0yIPjQJOF5eP5ej3yUxXz5zv7SiLzlljHT4XkrNY 50ysXwKPdtElIypngIzkNX7viSHnBAzIn9zWPuDwJ+AKi98VFPXuZ4CwF6OUVlcS6Uf1wsSkeNl YdzDDqU5aNBKjN3LtJs4ELN66QBfUty0F86cTT5HkiUsLYsR2LP6yeYgDoUfeYQJKEAf7raJFs6 xhFkwHDvDCpg2EN1LBQa4+EuI2GRGlZbJ94CWvouaonznMK/pzwjcjVkvNc6NjLgY6jH91tvdiL QCula2x+D6o7cYnwTo680fWROE+qRweipequhZNg8NUEX9Afx+YHh69ieOXjdE7uXEJaz1vLfHv B6AYu+uvfJdKNmHXTAf/UzimUuqofCh86abEr0gijkQwv9XhFg44ezhvuKKRihGu10op/qysPt4 gz81gjFRc+J43bfiXsw== X-Authority-Analysis: v=2.4 cv=F+7C5ahN c=1 sm=1 tr=0 ts=6aab21ac cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=VdqzKS8jKosA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=RzCfie-kr_QcCd8fBx8p:22 a=VnNF1IyMAAAA:8 a=t66Ke_tTvvCKYZqM8SYA:9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-16_03,2026-09-16_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 suspectscore=0 phishscore=0 clxscore=1015 malwarescore=0 lowpriorityscore=0 bulkscore=0 spamscore=0 impostorscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609160322 Content-Type: text/plain; charset="utf-8" When ibmvfc_send_event() returns H_CLOSED the event is freed without notifying the NVMe-FC transport. The caller ibmvfc_nvme_fcp_io() returns SCSI_MLQUEUE_HOST_BUSY back to the transport, which is a SCSI midlayer concept the NVMe-FC transport does not interpret. The result is that the NVMe-FC transport is left waiting on a request that was silently dropped, causing the I/O to hang permanently. Fix this by calling fcp_req->done() with a -EBUSY status before freeing the event in the H_CLOSED path, consistent with how other FC-NVMe LLDDs (e.g. lpfc) signal a retryable transport-level failure to the NVMe-FC transport. Fixes: 73c13e30c56f ("scsi: ibmvfc: implement nvme-fc IO command submission= callback") Signed-off-by: Tyrel Datwyler --- drivers/scsi/ibmvscsi/ibmvfc-core.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/scsi/ibmvscsi/ibmvfc-core.c b/drivers/scsi/ibmvscsi/ib= mvfc-core.c index 6c243b2a84d7..26a73db66254 100644 --- a/drivers/scsi/ibmvscsi/ibmvfc-core.c +++ b/drivers/scsi/ibmvscsi/ibmvfc-core.c @@ -1845,6 +1845,10 @@ int ibmvfc_send_event(struct ibmvfc_event *evt, dev_warn(vhost->dev, "Send warning. Receive queue closed, will retry.\= n"); if (evt->cmnd) scsi_dma_unmap(evt->cmnd); + else if (evt->fcp_req) { + evt->fcp_req->status =3D -EBUSY; + evt->fcp_req->done(evt->fcp_req); + } ibmvfc_free_event(evt); return SCSI_MLQUEUE_HOST_BUSY; } --=20 2.55.0 From nobody Fri Sep 25 04:07:46 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6716B4DA9D0; Wed, 16 Sep 2026 23:09:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789600187; cv=none; b=o/9omlqkGr3KV2u5hY9zgJvfm+7Zgju5StQIUOoOmE5dlTPkFpulAtRXcxH5wHZVClJZRmxPjVFcIfempIqjKQ4geOMQB+u6+s+KEa/sioEQPpBJtq7JsFHzoyTAouZ9uSDPiDJts592mXxIDRJPipQfoFxJBOZ23pe35HKCx3g= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789600187; c=relaxed/simple; bh=ob1Y6ojFXOojBTo/vmk1j3n/LLOzsFovl+d56cRYR1Q=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=XgGQjxV73A4v9bWGk/9nnQ3I7KZVlkMAK4AwOl9ERiqT19CtmPvKkpVAsRpesY6F7OrHar9Va7PoloLcMXlzIjBoVeDVrtrHuI4QSR6yVyz6aiTsaL5O6FDGAO66msc/wQqnsWSUKnotwrzVcTePVil4TP6syUTnbdQcI0YPBbg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=bvRjE5Wp; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="bvRjE5Wp" Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68GG1Yx4045799; Wed, 16 Sep 2026 23:09:34 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=pp1; bh=gvNzn7 ZMOYC+j9HE3k8E1WAb/wtbEy0YMdDUk1XNQhA=; b=bvRjE5Wpzxobgr/H2L8ery fwcu21es71ZKEDc9+ytS10FY5/Ko3ndPejrlhED6jMhZwdEOe5H9JRPGRKPGP9BT N39oP6QfsB2tERVNDMuxI6iSlhEaQRwQR34jDqbbYNsSUE2O0jKT2dig2kakNbHy bOHet5zL/rc6emjpDhhjpmnlcsvehl7pjfbTDOuLwiqNVSDPxTq9iKTM9UZM6nOJ I+3nr4m+r2TWmQWVip2l6V9isfLgj2H1ec+QGEEic5eS6N6fRpGMwys/gbeGwyF4 Pr/t0tDLzMB8Nla/CxhSpm5yqgAmsRPQOlFHW0MAWPaeBaGJJD3QScivhOI6q+4g == Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gmxcv6y0w-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Wed, 16 Sep 2026 23:09:33 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 68GN0AF71699615; Wed, 16 Sep 2026 23:09:33 GMT Received: from smtprelay03.wdc07v.mail.ibm.com ([172.16.1.70]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 4gq03vguf6-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 16 Sep 2026 23:09:33 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay03.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 68GN8n8S30540400 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 16 Sep 2026 23:08:49 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id B2B2958056; Wed, 16 Sep 2026 23:09:31 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id C60A458054; Wed, 16 Sep 2026 23:09:30 +0000 (GMT) Received: from li-4c4c4544-0054-3910-8039-c3c04f423534.ibm.com.com (unknown [9.61.141.190]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 16 Sep 2026 23:09:30 +0000 (GMT) From: Tyrel Datwyler To: james.bottomley@hansenpartnership.com, martin.petersen@oracle.com Cc: linux-scsi@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, brking@linux.ibm.com, davemarq@linux.ibm.com, Tyrel Datwyler Subject: [PATCH 04/20] scsi: ibmvfc: defer NVMe local port registration out of atomic context Date: Wed, 16 Sep 2026 16:09:05 -0700 Message-ID: <20260916230921.2204729-5-tyreld@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260916230921.2204729-1-tyreld@linux.ibm.com> References: <20260916230921.2204729-1-tyreld@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Info: AW1haW4tMjYwOTE2MDMyMiBTYWx0ZWRfX5b7HQJnafCoR 1rppFVMwr06eHsIyNNt3nJ4njmELwGuhRL49AXpsshqH7oErZDtHbfyJv8qxgUaBlpGDf/QayiS gmGPGqmrI1Fuq8WQDT/XwmzAfxpWr+I= X-Proofpoint-ORIG-GUID: VraI2bhDrSm8Xey1EeNuf9m3BRH5_Wkz X-Proofpoint-GUID: VraI2bhDrSm8Xey1EeNuf9m3BRH5_Wkz X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTE2MDMyMiBTYWx0ZWRfX2MpCJMHAoGq9 uFc04QmbJ2ME39GWulUc6WWW86hTa7e6LpXyzZB6ktjlG7Ect94CjIRh+0yYd1bMA0H6vfj942S eq/HLghbOJvPkEdgcb6Zmx+z4u5J/OHMaWVEGTPRrg7k9lw2MfzAbTaNMF57+c5ylsV45jnlYT6 0F28q0FUqAMtj5YgyyOjuj4zBlGijHC6PWc1nuO+cLEG4vNXGukOBhdjxL5tRQ7+LilpLedKO6j oJt89AaIYRPfOarTrbyt0OC294z9sbWJVn7kjTo2kiTuKVS3IU7OOgie94vG9ATwXJ+2IZi8m42 wNrc01mNIB5Mf33RZIYtspmjXIEgaVFtRGxLNxa8/LeIxX75QSFRv6y5/qsrp7L/uU26j/yagh2 LQBua9sT+tzQ3/hVe31afYp0RZw2RJ3yXXZqOwlkYXKCd4ytrpVGO9TGeHbQ/cl4wci+Ezn565c CnD2+2Xi6HKMNBXUGgQ== X-Authority-Analysis: v=2.4 cv=F+7C5ahN c=1 sm=1 tr=0 ts=6aab21ae cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=IkcTkHD0fZMA:10 a=VdqzKS8jKosA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=RzCfie-kr_QcCd8fBx8p:22 a=VnNF1IyMAAAA:8 a=_eyZQ5qQRCHSa_PPBJEA:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-16_03,2026-09-16_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 suspectscore=0 phishscore=0 clxscore=1015 malwarescore=0 lowpriorityscore=0 bulkscore=0 spamscore=0 impostorscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609160322 ibmvfc_fabric_login_nvme_done() is invoked under vhost->host->host_lock via the ibmvfc_locked_done() wrapper, which acquires the spinlock with IRQs disabled before calling the MAD completion handler. On the IBMVFC_MAD_SUCCESS path the handler called ibmvfc_nvme_register() directly. That function calls nvme_fc_register_localport(), which performs GFP_KERNEL memory allocations and may sleep =E2=80=94 both illegal inside a spinlock-held (atomic) context =E2=80=94 resulting in a 'scheduling while atomic' kernel panic during NVMe/FC fabric login. Fix this by replacing the direct call with a new do_nvme_register flag that mirrors the existing do_nvme_login pattern already used in the driver. The flag is consumed in ibmvfc_do_work() under the IBMVFC_HOST_ACTION_QUERY case, which runs in the kernel thread context (ibmvfc_work) where sleeping allocations are safe. The lock is dropped before calling ibmvfc_nvme_register() and re-acquired on return so the rest of the QUERY case proceeds normally. Fixes: 4eb644adc42f ("ibmvfc: register local nvme fc port after fabric logi= n") Signed-off-by: Tyrel Datwyler --- drivers/scsi/ibmvscsi/ibmvfc-core.c | 8 +++++++- drivers/scsi/ibmvscsi/ibmvfc.h | 1 + 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/ibmvscsi/ibmvfc-core.c b/drivers/scsi/ibmvscsi/ib= mvfc-core.c index 26a73db66254..420ddb958466 100644 --- a/drivers/scsi/ibmvscsi/ibmvfc-core.c +++ b/drivers/scsi/ibmvscsi/ibmvfc-core.c @@ -5245,7 +5245,7 @@ static void ibmvfc_fabric_login_nvme_done(struct ibmv= fc_event *evt) switch (mad_status) { case IBMVFC_MAD_SUCCESS: fc_host_port_id(vhost->host) =3D be64_to_cpu(rsp->nport_id); - ibmvfc_nvme_register(vhost); + vhost->do_nvme_register =3D 1; ibmvfc_dbg(vhost, "NVMe fabric login succeeded\n"); break; case IBMVFC_MAD_FAILED: @@ -6072,6 +6072,12 @@ static void ibmvfc_do_work(struct ibmvfc_host *vhost) vhost->job_step(vhost); break; case IBMVFC_HOST_ACTION_QUERY: + if (vhost->do_nvme_register) { + vhost->do_nvme_register =3D 0; + spin_unlock_irqrestore(&vhost->host->host_lock, flags); + ibmvfc_nvme_register(vhost); + spin_lock_irqsave(&vhost->host->host_lock, flags); + } list_for_each_entry(tgt, &vhost->scsi_scrqs.targets, queue) ibmvfc_init_tgt(tgt, ibmvfc_tgt_query_target); list_for_each_entry(tgt, &vhost->nvme_scrqs.targets, queue) diff --git a/drivers/scsi/ibmvscsi/ibmvfc.h b/drivers/scsi/ibmvscsi/ibmvfc.h index ca80ceffe53a..df0775183d72 100644 --- a/drivers/scsi/ibmvscsi/ibmvfc.h +++ b/drivers/scsi/ibmvscsi/ibmvfc.h @@ -1005,6 +1005,7 @@ struct ibmvfc_host { unsigned int nvme_enabled:1; unsigned int do_scsi_login:1; unsigned int do_nvme_login:1; + unsigned int do_nvme_register:1; unsigned int aborting_passthru:1; unsigned int scan_complete:1; int scan_timeout; --=20 2.55.0 From nobody Fri Sep 25 04:07:46 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 40C4D4CDA39; Wed, 16 Sep 2026 23:09:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789600184; cv=none; b=AxgoDmchSQEySL4fOjOeFHRW0k1uBYIGlQBlG8gLxIMJLf2RlLEGsV1SKHERZnQ3Bp/gFmu3qu7YJDEwjYGUF5GVLWBc2KJdbQgbTPyJJVAt8UcKquRuJy+CEtExT8+Lws75+Y7X2Hh/Qc3Xwi2a5orfTdS94DsCAHkKVhiIPcw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789600184; c=relaxed/simple; bh=zJ6L1QAlhR+1HXypefU7avEpVe9R03mjn5C+8OtqXyM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=fnBtf76FOFt5A3SJxBUyWU5XGbOk8BN5vtYmX+E5lkPdzpSlq/Zrugvb3ZXkbG5D+H1bN6wkeionlX2S80i3xWek+GAX8sU7awkyyUKSOEPD38Vs3tvX1YkFLXUqeciiIb9jjT0JjsUWJsCYQdaopiu5HA8GGIHspMTSkKrplXs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=CN6Bpi7s; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="CN6Bpi7s" Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68GG1Yx5045799; Wed, 16 Sep 2026 23:09:35 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=pp1; bh=Ssa+kO Pw6tapYQKMBt9xIFOJDUDAQJSNTivqb+/sVdg=; b=CN6Bpi7sEvDtB0CK3sDMsv TShXRLUgtwallfyey8xYjkfyKdr7D0VCD0XUMmcmYYzJxfgqznosDLZ9I5DcSNs8 6ZbZLLFKcLUDLHHw10BTrVO/RqxXQf53IuwnUFp3T08/zC0G2nOlhgaFMj9V+i1L ssIcuclccsm241fPSjMYqWXS7olIoyJAof9htZLfB7TBUYr2t01IVlwaQwAmzIJK zzU1AbahxSdkXI6RgAj2yN5RPSmnwZ7yq6ceNcy86VDVwOG0uhfHEiyfBJESVhUP ejTyslb1pZGbn8tevxFquPl/TyiTZrNrWHvcQZ3xfqQc4D1EUbOJfvAF6ieU0Riw == Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gmxcv6y0y-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Wed, 16 Sep 2026 23:09:35 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 68GN12qB1713037; Wed, 16 Sep 2026 23:09:34 GMT Received: from smtprelay04.wdc07v.mail.ibm.com ([172.16.1.71]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4gpywf0w4j-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 16 Sep 2026 23:09:34 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay04.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 68GN9WVB16646910 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 16 Sep 2026 23:09:33 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id CEC615804E; Wed, 16 Sep 2026 23:09:32 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id DE7B058054; Wed, 16 Sep 2026 23:09:31 +0000 (GMT) Received: from li-4c4c4544-0054-3910-8039-c3c04f423534.ibm.com.com (unknown [9.61.141.190]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 16 Sep 2026 23:09:31 +0000 (GMT) From: Tyrel Datwyler To: james.bottomley@hansenpartnership.com, martin.petersen@oracle.com Cc: linux-scsi@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, brking@linux.ibm.com, davemarq@linux.ibm.com, Tyrel Datwyler Subject: [PATCH 05/20] scsi: ibmvfc: fix uninitialized _done dereference for TMF events on send failure Date: Wed, 16 Sep 2026 16:09:06 -0700 Message-ID: <20260916230921.2204729-6-tyreld@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260916230921.2204729-1-tyreld@linux.ibm.com> References: <20260916230921.2204729-1-tyreld@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Info: AW1haW4tMjYwOTE2MDMyMiBTYWx0ZWRfX+5CyZkki3zac ZffQLbGS3a8xsEtlqKUhepjTrP25egmPF6XoZPnQdfA+HlEfvfBirQ9rW7EGu/4XozvGqL8aP1l FCQivsiTB2h8MadJDl7iMx9Yddg7t60= X-Proofpoint-ORIG-GUID: 7nnLSzqbydesDcX92fMzEmzKZ3KIbfiK X-Proofpoint-GUID: 7nnLSzqbydesDcX92fMzEmzKZ3KIbfiK X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTE2MDMyMiBTYWx0ZWRfX76mJxO8I8vCp mBK/9voZHmRIV5qqBN61rTFrY24cHfQ3LBPwbmSO6eDSHVLTSdOHpD99y/h8C6ht9uF4Dg4vHNG CwqbC3WzCtXeuuASuJQRg1iPl6VogbTTAedilx+B+5gfPA7hLhDcsQwgxGxjOUxlRPv/gTxvBLQ o8lGXxWRVNtB90R0zNawe9706aCnvpqdbzOzRIEB4GAzT1cdJIaslfA+eAThL0K7MGNmTEBgMT0 iJYIk0nKU/Sm6mEDwZu37v88vCOdl5vq3cVLsR2xNsSKJXml0EuD7KWOUdpYN06/Tsl+6kC7TyL jWTcQGx/+myQZZtKEBnwSTvEfY4cCYIYUe+C9C1hayh+AN5XoEl9X67/Vr+xjDdNiiYdMJKcVc8 YTZU4bgnvwuQ3BvoxPmHQKe9drZWSqbfomytNYlG4k38G7lzW9yrlCleQYi3+jrtFdQmv9U0SW/ KrQ91Ojlw8jP7ZHg8Ig== X-Authority-Analysis: v=2.4 cv=F+7C5ahN c=1 sm=1 tr=0 ts=6aab21af cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=IkcTkHD0fZMA:10 a=VdqzKS8jKosA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=RzCfie-kr_QcCd8fBx8p:22 a=VnNF1IyMAAAA:8 a=qtjYkiDot-WfiDIOCeAA:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 a=O8hF6Hzn-FEA:10 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-16_03,2026-09-16_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 suspectscore=0 phishscore=0 clxscore=1015 malwarescore=0 lowpriorityscore=0 bulkscore=0 spamscore=0 impostorscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609160322 In ibmvfc_send_event(), the non-H_CLOSED error path uses a bare else clause to handle the case where evt->cmnd is NULL, assuming the event must be a MAD and reassigning evt->done =3D evt->_done before calling it. However, SCSI Task Management Function (TMF) events created by ibmvfc_init_tmf() are initialised with IBMVFC_CMD_FORMAT, not IBMVFC_MAD_FORMAT. ibmvfc_init_event() only populates evt->_done for IBMVFC_MAD_FORMAT events; for IBMVFC_CMD_FORMAT events evt->_done is never set. Since TMF events also have evt->cmnd =3D=3D NULL (cleared by ibmvfc_init_event()), they fall through to the bare else branch, copying the uninitialised evt->_done into evt->done and immediately calling it =E2=80=94 a wild function-pointer dereference that results in a kernel panic during SCSI error recovery under SAN error conditions. Fix this by replacing the bare else with 'else if (evt->crq.format =3D=3D IBMVFC_MAD_FORMAT)', gating the _done reassignment strictly on the MAD format where evt->_done is guaranteed to be valid. TMF events (IBMVFC_CMD_FORMAT, cmnd=3D=3DNULL) no longer reach this branch; their evt->done (ibmvfc_locked_done wrapping ibmvfc_sync_completion) remains correct as initialised, allowing the waiting ibmvfc_cancel_all_sq/mq paths to receive the completion normally. Fixes: 98e0f82a0d3f ("ibmvfc: split NVMe support into separate source file = and add transport stubs") Signed-off-by: Tyrel Datwyler --- drivers/scsi/ibmvscsi/ibmvfc-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/scsi/ibmvscsi/ibmvfc-core.c b/drivers/scsi/ibmvscsi/ib= mvfc-core.c index 420ddb958466..89d271adccd0 100644 --- a/drivers/scsi/ibmvscsi/ibmvfc-core.c +++ b/drivers/scsi/ibmvscsi/ibmvfc-core.c @@ -1859,7 +1859,7 @@ int ibmvfc_send_event(struct ibmvfc_event *evt, evt->done =3D ibmvfc_vfc_eh_done; } else if (evt->fcp_req || evt->ls_req) { evt->done =3D ibmvfc_vfc_eh_done; - } else { + } else if (evt->crq.format =3D=3D IBMVFC_MAD_FORMAT) { evt->xfer_iu->mad_common.status =3D cpu_to_be16(IBMVFC_MAD_CRQ_ERROR); evt->done =3D evt->_done; } --=20 2.55.0 From nobody Fri Sep 25 04:07:46 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0EDB04B3364; Wed, 16 Sep 2026 23:09:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789600188; cv=none; b=ijp55JGiQh7R0/fNF/JEHal2btE7tiv+unN/q/RF96vg+h7U0DiY+Bdp6fqW+gtLgcuhXltmRpITewVGKt6aLBUCiBZASGpIp7Xf+3h5yh766NaHgsjyBCTtYYlbtUqMVnu7BUS9OSM7SKd/YJ/v0M9O6WU6Jv22+cwNZKLC+wo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789600188; c=relaxed/simple; bh=sHHsot734wKdZrsWxsa4oMrwTbt/buIICjgFD7kozZI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Q2MV+TbwhNe1LPs1ERCmH6eY6KnueQz6H9mClPId9UndGPEfxt77nuv2jOS8lmU5tHwhAGkJUGrhLmT2lBaImfrfcP+WI6cUA0hFxBTlF5QxG+kJxHBM0RWFRoc9Y250Y3mNO8dbQbwE+R0IdsczclaCMAM+XpWycf44tMOsB3M= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=MNgYltOo; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="MNgYltOo" Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68GG1lfO018176; Wed, 16 Sep 2026 23:09:36 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=o1CfTnt7tCAhaHJI/ WnTpzZU6etw47JbmZnc24rhFcw=; b=MNgYltOowVX3/aRo/gl3ZZ3w+UI8btlse ncJZozvCyZAW3DmD50f8nPrDL13VRwcjX58qKyZdmet4EIHym5ffFBFBQ+WQcwS6 +N5G6+GmUZTIZPCvrq80v9n0U6/PIm27i1Fn1q5tILdqz+h6SuoGExpQUeom1NTP spVtNDvu4+0doyWRswFUddD2xvkH0gsBic9LtG0aGt2aNKQdXGHorCni6wgY6pfb m7PHo5OQUuTnWBlQOCyMxRT35zNHaiOr/fP0LnaGSlK+wdkj08uCs0QRYrmYnpxk eqf26BtTOhrdnpMZpUbBa97rH2wS4BxuXt0YtAT9Rea8XcIqpTSvg== Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gmxf57dx6-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Wed, 16 Sep 2026 23:09:36 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 68GMrtML2599742; Wed, 16 Sep 2026 23:09:35 GMT Received: from smtprelay06.wdc07v.mail.ibm.com ([172.16.1.73]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4gpw6d9e8v-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 16 Sep 2026 23:09:35 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay06.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 68GN9Yq928770900 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 16 Sep 2026 23:09:34 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id E86FE5804E; Wed, 16 Sep 2026 23:09:33 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 0847C58054; Wed, 16 Sep 2026 23:09:33 +0000 (GMT) Received: from li-4c4c4544-0054-3910-8039-c3c04f423534.ibm.com.com (unknown [9.61.141.190]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 16 Sep 2026 23:09:32 +0000 (GMT) From: Tyrel Datwyler To: james.bottomley@hansenpartnership.com, martin.petersen@oracle.com Cc: linux-scsi@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, brking@linux.ibm.com, davemarq@linux.ibm.com, Tyrel Datwyler Subject: [PATCH 06/20] scsi: ibmvfc: fix uninitialized shwqs in ibmvfc_purge_requests() Date: Wed, 16 Sep 2026 16:09:07 -0700 Message-ID: <20260916230921.2204729-7-tyreld@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260916230921.2204729-1-tyreld@linux.ibm.com> References: <20260916230921.2204729-1-tyreld@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: vKMv2fcnSYksN2dgCdN3-agYadtpturC X-Proofpoint-Spam-Info: AW1haW4tMjYwOTE2MDMyMiBTYWx0ZWRfXyloi5lHjgfKV MopVwh3ipNupzrRAovmS+ott71L9q1l8v3/nPbSgDFJb+tEwhn49D1jp+6KbmW5rdB6RcG2JFUV gmNTXz7uOWuMt1BlkhVXOWdDyomyusc= X-Authority-Analysis: v=2.4 cv=cvgOAF4i c=1 sm=1 tr=0 ts=6aab21b0 cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=VdqzKS8jKosA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=U7nrCbtTmkRpXpFmAIza:22 a=VnNF1IyMAAAA:8 a=6DixLaR-r_zTwfx8U4UA:9 X-Proofpoint-ORIG-GUID: vKMv2fcnSYksN2dgCdN3-agYadtpturC X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTE2MDMyMiBTYWx0ZWRfX6S3SHj0UMynf aWoSWgFBY4eyF/kT3/xqpq1//JIhLKWNBRZAr+N7RT4IP1Qp26Ue69NfEPsdZP50ce+CS+aFSSB YZFQwp/m4sOeouTjMcJQWXgxBSOC/db0xAkOBV1IfzVJg2TiQm5KpClGgo8RTU1j9n3HZ9E7JdN p01WV4tIwzWxz+ElZxxu0ZkzWwqD4I35JAJhpFWwwhDsnu1DP6EYuhoWLsnYnzsBL7DO8IltwQh wni5ZgGWyMSZe1xPTAy4L+8o0xevyLmASCJxblYcaRJ2wKlG98gu4fNlvad5nVap6mln10cyqJ2 L0AKIJzL6X6M4gEUXbSpyz1YH47szthQl544vVqm2szDP2UrlLlZEvyljfNFZSCjbBZayhJLylj qI8UkYM4FxLgyFnm3CqhI6J8V6q4T58BqydWo7dgyMSaoAkgkIR8eW0H5LW0BsXwJjWjycGL9Zl vPUGGssDVqTwSHzRPGQ== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-16_03,2026-09-16_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 lowpriorityscore=0 clxscore=1015 priorityscore=1501 suspectscore=0 bulkscore=0 impostorscore=0 phishscore=0 spamscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609160322 Content-Type: text/plain; charset="utf-8" In ibmvfc_purge_requests() the variables shwqs and nhwqs are declared as: int shwqs, nhwqs =3D 0; This initialises only nhwqs to zero; shwqs is left uninitialised. Both are assigned inside the 'if (vhost->using_channels)' block, so when using_channels is false the block is skipped and shwqs retains its garbage stack value. The subsequent loop for (i =3D 0; i < shwqs; i++) then iterates an arbitrary number of times over scsi_scrqs.scrqs[], which may be NULL on the non-channel path, resulting in out-of-bounds heap accesses and a kernel crash during any adapter reset or shutdown that occurs before channels are established. Fix by initialising shwqs to 0 in the declaration so that both loop bounds are zero when using_channels is false and neither sub-queue loop executes. Fixes: ffc022564293 ("ibmvfc: fail nvme-fc fcp-io and ls requests during tr= ansport reset") Signed-off-by: Tyrel Datwyler --- drivers/scsi/ibmvscsi/ibmvfc-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/scsi/ibmvscsi/ibmvfc-core.c b/drivers/scsi/ibmvscsi/ib= mvfc-core.c index 89d271adccd0..18e7a462e32d 100644 --- a/drivers/scsi/ibmvscsi/ibmvfc-core.c +++ b/drivers/scsi/ibmvscsi/ibmvfc-core.c @@ -1188,7 +1188,7 @@ static void ibmvfc_purge_requests(struct ibmvfc_host = *vhost, int error_code) struct ibmvfc_queue *scsi_q =3D vhost->scsi_scrqs.scrqs; struct ibmvfc_queue *nvme_q =3D vhost->nvme_scrqs.scrqs; unsigned long flags; - int shwqs, nhwqs =3D 0; + int shwqs =3D 0, nhwqs =3D 0; int i; =20 if (vhost->using_channels) { --=20 2.55.0 From nobody Fri Sep 25 04:07:46 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3C4423672AF; Wed, 16 Sep 2026 23:09:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789600187; cv=none; b=n9BcCsLD9i3SrObji/sZkyREeSCg32lO9QqwOTZiITTjeteTU4yZgdpcCdmBT3SDS/Ev1qKfVT+gGGLQOrstPS4ro27cyIJf9e6/QZ2iTRP2J2nv/bYCI9zY79fBuOj4KwCDYCuutlE+AOFkR/8rxwRBnZVsScV/HakNPDSHVO0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789600187; c=relaxed/simple; bh=tUtaWbur0QmkgQCjkqSrBsGo2lGsoBBIIO81ja21X2I=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=iKLfJJbTYrOzgu0v5XrTKBdRHO4wA5lSoog4mcM2s7KQljUXmN0BSKXrWYeY5yg9e0m6J00xuCxPrXmQzPoMrQJKVZMxEWEueBNh2S97NMma0R8fiNb1JkjagSzPn8aAnLI5Wa39SMJIK+rUfPkFxP/f6Q6/RNZAOevKR/VKHME= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=SNm9OgwZ; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="SNm9OgwZ" Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68GG1oY32330700; Wed, 16 Sep 2026 23:09:37 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=0/D2WZgW8ZUpM0jYn MsgllEp9stvQoyFzifPfHfFtSc=; b=SNm9OgwZvNYHDkSOxyH6UPAQqnkLVvznt pNIBnEgdi8AJbwmr3CxlsddpYfN/NhzqOL5ty51BQfxcdiYdyGDciGl7+1OwU/Pz HEI7GBlmsVTPFWegAAvn4Aa5+lUhMSeJdaPZmMjXchi0gIuhjDigx5VIx1MhGSC5 TpqcCtm6s//yYvVglDeGgzLXcwTnNFqQRxCcuzvntWXNFdMkf/bKPY3yDqbwGkk6 RZ8xX1ypVZiAUA9xe2+Qb/B2e2dWAJcXY1Ixptk64x+tGHeggOFUwqUpT/o/tb9A AOBrdEoiJqYS9q7mw+bm5yKMgpgM8+OJP8Dpr682DSh/EajNZHcmg== Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gmxdqfd9y-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Wed, 16 Sep 2026 23:09:37 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 68GMjrVZ2599760; Wed, 16 Sep 2026 23:09:36 GMT Received: from smtprelay07.wdc07v.mail.ibm.com ([172.16.1.74]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4gpw6d9e91-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 16 Sep 2026 23:09:36 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay07.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 68GN9ZqQ15598176 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 16 Sep 2026 23:09:35 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 1578E58054; Wed, 16 Sep 2026 23:09:35 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 270905804E; Wed, 16 Sep 2026 23:09:34 +0000 (GMT) Received: from li-4c4c4544-0054-3910-8039-c3c04f423534.ibm.com.com (unknown [9.61.141.190]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 16 Sep 2026 23:09:34 +0000 (GMT) From: Tyrel Datwyler To: james.bottomley@hansenpartnership.com, martin.petersen@oracle.com Cc: linux-scsi@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, brking@linux.ibm.com, davemarq@linux.ibm.com, Tyrel Datwyler Subject: [PATCH 07/20] scsi: ibmvfc: fix uninitialized status logged on LS abort send failure Date: Wed, 16 Sep 2026 16:09:08 -0700 Message-ID: <20260916230921.2204729-8-tyreld@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260916230921.2204729-1-tyreld@linux.ibm.com> References: <20260916230921.2204729-1-tyreld@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTE2MDMyMiBTYWx0ZWRfX2CJFOvuSmWRU JvdaiadTiu7/scAI1IKRm2Gg1/oOBuFwkaa1gqnRj1PsaZMx54ZqEKJM/dpVAhGUx3loyXYfvzI fjnDaiBt4plvVxQmx/eEUnpgO6kwP20xK06OtQsnhOF5SM0uInG08AlwGM4D9ee+80pKdjteO4z BQ19rjHbiupHmompuck353FKqcq5ypx5VPWydrkcgci0OLX92F43SdGBx/iP4Rvvge+QwtCXXYm lw4riNsFsOLWgi73pFAGtDVwKT5r7fRbFoAbAOdWJm9Peifwn5L9EU5dWu/9IPn7f61wSMWQT7J NB5BaYiD67AByFlg6ukS0jd9+7NYW3Q2dnvyZ0VnzAo2jCJS1lQFw7pjkh3Kki7kBttnTnNXfgN Ap2c0Y8z248Sj29cZRBLgzXumJ4A7Z2oef6e73anAp0BfekKLr8OOjRnJeqI16POH3uWe+Vqpup kfzTwK23WovTrVEXuUQ== X-Proofpoint-GUID: pTwCKefeuy2YW38mqfFbFOE1qurfBAXm X-Authority-Analysis: v=2.4 cv=DobDa2/+ c=1 sm=1 tr=0 ts=6aab21b1 cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=VdqzKS8jKosA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=VnNF1IyMAAAA:8 a=dm6BVu0w9rUwWJiP_yAA:9 X-Proofpoint-ORIG-GUID: pTwCKefeuy2YW38mqfFbFOE1qurfBAXm X-Proofpoint-Spam-Info: AW1haW4tMjYwOTE2MDMyMiBTYWx0ZWRfX3MOQk2NpDT3s k6D3D/ISTcis8gnXZhZBnFI0mE1beURduh7RsJtxk/RIqHruz961u8IyZUh85mPy10CX7TMOpFq mFiRJcDI5QJnvs3onlpdxl706sAoePM= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-16_03,2026-09-16_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 malwarescore=0 priorityscore=1501 suspectscore=0 impostorscore=0 spamscore=0 clxscore=1015 adultscore=0 bulkscore=0 lowpriorityscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609160322 Content-Type: text/plain; charset="utf-8" In ibmvfc_nvme_ls_abort(), 'status' is declared without an initialiser. It is only assigned at line 223 on the ibmvfc_send_event() success path: wait_for_completion(&evt->comp); status =3D be16_to_cpu(rsp.mad_common.status); When ibmvfc_send_event() fails the code jumps via 'goto out', skipping the assignment entirely. The ibmvfc_dbg() call that immediately follows the out: label then reads uninitialised stack memory and logs a meaningless status value. Fix by initialising status to IBMVFC_MAD_CRQ_ERROR at its declaration. This sentinel accurately reflects that the underlying CRQ send failed and produces a meaningful log message on the error path. Fixes: 508e0371279894 ("ibmvfc: implement nvme-fc LS abort handling callbac= k") Signed-off-by: Tyrel Datwyler --- drivers/scsi/ibmvscsi/ibmvfc-nvme.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/scsi/ibmvscsi/ibmvfc-nvme.c b/drivers/scsi/ibmvscsi/ib= mvfc-nvme.c index 9ed6522c2e9e..ddd750f1cf33 100644 --- a/drivers/scsi/ibmvscsi/ibmvfc-nvme.c +++ b/drivers/scsi/ibmvscsi/ibmvfc-nvme.c @@ -202,7 +202,7 @@ static void ibmvfc_nvme_ls_abort(struct nvme_fc_local_p= ort *lport, struct ibmvfc_event *evt; union ibmvfc_iu rsp; unsigned long flags; - u16 status; + u16 status =3D IBMVFC_MAD_CRQ_ERROR; =20 evt =3D ibmvfc_get_event(&vhost->crq); if (!vhost->logged_in || !evt) --=20 2.55.0 From nobody Fri Sep 25 04:07:46 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0D6C34AF9F5; Wed, 16 Sep 2026 23:09:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789600188; cv=none; b=UfbBGIxhHalosWEzn5uLq5lbgR7dzuBUtplwe7pZHTjM08kt2rixWlIgh9EkIVMIEEFLBHWh1kW3ZASdXjKtxuB7zEKfP+JD2N2h8hsqXroe0n+h5Vgz9y0CoCDPvOSVZ0mxX3OIIEMCk8MFGjj8G2Ed9MVgtM6ChUtBFD2EASA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789600188; c=relaxed/simple; bh=/5FqGFLQYeObNAYoBHUgWymNMUJBDZRB9oe6QVysWPU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=KdPQgD5ULgWpL50wo7V12yA9sV5szp/dr72jeA7N4vWdVz0negX6BqfjMTCxC5eWfNyy61M1epHp44WdPk0gthJdFeVaPf5a5jmxnVOXMHtid2X9fxB4dAkcdUWh8ITsaz5kks7VnyuPO0vkdNbQp/7ElHm5DEXsFZObC1WaILc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=AqldeH+T; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="AqldeH+T" Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68GG1Wdg045787; Wed, 16 Sep 2026 23:09:38 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=C5onI7nGbbEzwmDVs NCVJsX5ON7EKqRDjrSLCbBoHVE=; b=AqldeH+TqBQoagZVYHvllwJoyYVqYWQRJ YuoIV9Uq9UKR/K1MK3tPosldQqRtCWEOaeHe1UNEexZbG05yy8f5vdYrpDDiK9dc bhhFCb+gL+8qKOxiatktKi7SIfD5XmhMxSIu7pq+1ihVTyijscwR0skGimXeTjQU FmSxyXaOMwe1aiyfNb7L0Jbe6eaVBDO1a1D/sywFXbpOTCkcZxoqjDaEqN+ZbDGO crvAxySdUfp/JanLCuyuB63LBhEVU3KjwcxxO6Jwkj20XQdSwWeQXW0uomg1Qhha FRyAViM2E5tw4g8+LDIee0d4GVCh1SNsTBeaDKtiTiFYHY1FiLpZg== Received: from ppma23.wdc07v.mail.ibm.com (5d.69.3da9.ip4.static.sl-reverse.com [169.61.105.93]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gmxcv6y11-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Wed, 16 Sep 2026 23:09:38 +0000 (GMT) Received: from pps.filterd (ppma23.wdc07v.mail.ibm.com [127.0.0.1]) by ppma23.wdc07v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 68GMtCeS1663520; Wed, 16 Sep 2026 23:09:37 GMT Received: from smtprelay02.dal12v.mail.ibm.com ([172.16.1.4]) by ppma23.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4gq089rtj7-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 16 Sep 2026 23:09:37 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay02.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 68GN9akm13501100 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 16 Sep 2026 23:09:36 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 322D258056; Wed, 16 Sep 2026 23:09:36 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 422F15804E; Wed, 16 Sep 2026 23:09:35 +0000 (GMT) Received: from li-4c4c4544-0054-3910-8039-c3c04f423534.ibm.com.com (unknown [9.61.141.190]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 16 Sep 2026 23:09:35 +0000 (GMT) From: Tyrel Datwyler To: james.bottomley@hansenpartnership.com, martin.petersen@oracle.com Cc: linux-scsi@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, brking@linux.ibm.com, davemarq@linux.ibm.com, Tyrel Datwyler Subject: [PATCH 08/20] scsi: ibmvfc: fix inverted suppress-ABTS capability check in NVMe TMF path Date: Wed, 16 Sep 2026 16:09:09 -0700 Message-ID: <20260916230921.2204729-9-tyreld@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260916230921.2204729-1-tyreld@linux.ibm.com> References: <20260916230921.2204729-1-tyreld@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Info: AW1haW4tMjYwOTE2MDMyMiBTYWx0ZWRfX3rYvCwDhSr65 eP617f1qG7jUrikn0k6oVyxiZ8NyvOMrxfvqyDjN9S4qV+S111wOxlQzzaBmpY6IYCdNRXhYeL+ UWuglgHcTOQwUbmgXJRM48aQKDWlQlY= X-Proofpoint-ORIG-GUID: 4He5hSmTRCKvs3TusQyk7piSPT8JTVaD X-Proofpoint-GUID: 4He5hSmTRCKvs3TusQyk7piSPT8JTVaD X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTE2MDMyMiBTYWx0ZWRfX7OVXFU60PpL7 knRst2cwWrnba2LBw/nEPfuIUVvRzCiDMhKqXTkKLE7uCYAEjdfgL+2SrewKkIniXuI+AszwTqC idN+5FXAOqowOs4fcC9KHx8yhfHt8p47lgVNh4Hhh9micXwZfi/SKAMdJ0Ooi2Sl263AKZCPdbq 3YY+z2Ng9w0QHJ+unuiEtBMUiEnml9Efl5Z/2Yoy1UIPwPlK28qDZGWp6bzPb8bNiSYBhIFOdxI CqbrOl+bmWKCDIW/0EfCs7OiyLAJDCiAH1KpTGvV4wsyeP9K7LfZE62Lj2leGwSfDEHPYZK/20O da1niZvDendo8Nu5hHhkjfLIS758OhqMpFcBHCnT1/yQ53NE6F9HAuwrkB389Yxauo9Rgv+3Nv2 K3LOO+XZtBqPKe5l3tEO+9wTBymidKn5aw8+3CaTQ0YFLZgxRrHoOcGL4t23dJJGosvRoNTiXdB mqro/oQdsMHnMLtEc3Q== X-Authority-Analysis: v=2.4 cv=F+7C5ahN c=1 sm=1 tr=0 ts=6aab21b2 cx=c_pps a=3Bg1Hr4SwmMryq2xdFQyZA==:117 a=3Bg1Hr4SwmMryq2xdFQyZA==:17 a=VdqzKS8jKosA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=RzCfie-kr_QcCd8fBx8p:22 a=VnNF1IyMAAAA:8 a=4DjNXy2qQgjy61e-tjkA:9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-16_03,2026-09-16_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 suspectscore=0 phishscore=0 clxscore=1015 malwarescore=0 lowpriorityscore=0 bulkscore=0 spamscore=0 impostorscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609160322 Content-Type: text/plain; charset="utf-8" ibmvfc_nvme_setup_fcp_abort() sets the IBMVFC_TMF_SUPPRESS_ABTS flag only when the adapter does NOT have the IBMVFC_CAN_SUPPRESS_ABTS capability, which is the exact opposite of the intended behaviour. Remove the erroneous '!' negation so the flag is set when the adapter actually reports the capability, consistent with how the SCSI TMF path in ibmvfc_cancel_all() handles the same check. Fixes: 508e0371279894 ("ibmvfc: implement nvme-fc LS abort handling callbac= k") Signed-off-by: Tyrel Datwyler --- drivers/scsi/ibmvscsi/ibmvfc-nvme.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/scsi/ibmvscsi/ibmvfc-nvme.c b/drivers/scsi/ibmvscsi/ib= mvfc-nvme.c index ddd750f1cf33..7fdf27fbe7e7 100644 --- a/drivers/scsi/ibmvscsi/ibmvfc-nvme.c +++ b/drivers/scsi/ibmvscsi/ibmvfc-nvme.c @@ -184,7 +184,7 @@ static void ibmvfc_init_ls_abort(struct ibmvfc_event *e= vt, struct nvmefc_ls_req tmf->common.opcode =3D cpu_to_be32(IBMVFC_NVMF_TMF_MAD); tmf->common.length =3D cpu_to_be16(sizeof(*tmf)); if (vhost->state !=3D IBMVFC_ACTIVE) - if (!ibmvfc_check_caps(vhost, IBMVFC_CAN_SUPPRESS_ABTS)) + if (ibmvfc_check_caps(vhost, IBMVFC_CAN_SUPPRESS_ABTS)) tmf->flags =3D cpu_to_be32(IBMVFC_TMF_SUPPRESS_ABTS); tmf->cancel_key =3D cpu_to_be32((u64)abt_evt); tmf->my_cancel_key =3D cpu_to_be32((u64)evt); --=20 2.55.0 From nobody Fri Sep 25 04:07:46 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 92E8F4D7D29; Wed, 16 Sep 2026 23:09:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789600189; cv=none; b=lFBj64gdYDz77xfhzPTrV4QrJGgkEszkLfk8JUAobmkExXmxqeceuwQ3GqQ5PydMpN4imTEVZzhlk67D8h155lVcGooDUvmGAR92+GXx1vyDT66p5nwQgKo5HV/RBkHZSImFAI0oQWY2e976FfIqVFm+WzjowSkQ9Evc4nspDAw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789600189; c=relaxed/simple; bh=tm/nKFgTUqADr5iWyStu3PFbisxvORDM1FA+iBvRng0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=kTB0HovI8e/+UU47X9w9t/t3B6y7wd4QdIzs6oEbGZM7LaDTnNgIMdICV3rw1AnxohTsvyOCbW4hNoQjzXY1wNHEgbBPBIwZPjzQWEq/E1AsnDA1lyZn+90m3C0cbA1+t0f7BktFK/lRLBE8AFcLc7VWd6rPh6Dr0iABOckfSDc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=GMDVNlka; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="GMDVNlka" Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68GG1bbM4057211; Wed, 16 Sep 2026 23:09:39 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=FrLC2oNPttFPs4Vfk 4Y4zUrmTP6nitaE45z1d6F8D/k=; b=GMDVNlkawJCL6S70MYeRJFUaDQ14zItU/ jD9X1ik3RvyOiMslpDcxD/7cO/3Coj21Vg01HyNogNzBJH3TxB9SWwmmseMlZXVo qfQz8xfnddBSx5mYXH4biOoIK9HSvpuyJIcYWNQRFq6U4tWVwQ7yT4SalcfBdhhj mI3bKlu1oiC1Q9l6jzvHLkaiUeRF7MTs1KVHWq1g0W74M13M4ECplrKDyCqo0Wmp 7dXKXp80RemIK094RDzbQoZrCr1bF86xyiz4uDQL+GV4ZNfQT3yTmy3c+1OfLZTO ye5PVvft/PIXWNP8xvLgdS8EBAeCqxmJaHsywJMDtcFDVNQyj2GEw== Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gmv5hy9v6-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Wed, 16 Sep 2026 23:09:39 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 68GN0dv82599738; Wed, 16 Sep 2026 23:09:38 GMT Received: from smtprelay03.dal12v.mail.ibm.com ([172.16.1.5]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4gpw6d9e93-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 16 Sep 2026 23:09:38 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay03.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 68GN9baI53477874 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 16 Sep 2026 23:09:37 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 4F5B758060; Wed, 16 Sep 2026 23:09:37 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 5EB0D58054; Wed, 16 Sep 2026 23:09:36 +0000 (GMT) Received: from li-4c4c4544-0054-3910-8039-c3c04f423534.ibm.com.com (unknown [9.61.141.190]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 16 Sep 2026 23:09:36 +0000 (GMT) From: Tyrel Datwyler To: james.bottomley@hansenpartnership.com, martin.petersen@oracle.com Cc: linux-scsi@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, brking@linux.ibm.com, davemarq@linux.ibm.com, Tyrel Datwyler Subject: [PATCH 09/20] scsi: ibmvfc: fix infinite reset loop on NULL evt in implicit logout path Date: Wed, 16 Sep 2026 16:09:10 -0700 Message-ID: <20260916230921.2204729-10-tyreld@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260916230921.2204729-1-tyreld@linux.ibm.com> References: <20260916230921.2204729-1-tyreld@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTE2MDMyMiBTYWx0ZWRfX+6lJ0kJDM/Ee ztVYrJerrGxA8bdFmPUvO4dBhxpkHjIreBxa5gIjPV+Dem3o4Z78m5sVLGvnko7IN27JU09urOF 4JtQjU/ZDhztFlbKd9I8F/dxX2notzxQlRO/hi3t9wChnWs2kDl64ayo/K/7Qln3D6fbBdSKTav qiadETwtqJDb7c2OjKaId9PkgJnEUioEfUOAh2YGoqNP08I9sf0a3KpM5BUtYUqsv22oZijNyis anfp70Kd2cHrWdD+adVzp4r1MNneEXV1NKVZTWosONbuFE8YldD/+cq03AziLEsUsbceACI3sJZ TMiUzlJo9bu/iCC9vHsAXrekQ2OhyHgMVrV+WP/YwIZlTx9ycP1lwS1Dr1t2btvDD8mOR1q1UdP 6MgXhx0/zqYzFYItAaVnZmptI99VviYH/Rk1HO6v0JImG8Nqm6xhhYsA4vW9OjH8CF24CooOcd0 MmhY44/MA9kpaJS7lhg== X-Proofpoint-Spam-Info: AW1haW4tMjYwOTE2MDMyMiBTYWx0ZWRfX6+qAfU7ur3Iq OCgycOUOtxnpKf1/vuzmK7+BYAq/yK2f2Ylz82hYo7Qk2UlvxPVPNo/cU+Bfxf+L7i0pqnxopol 0gcN9BpZ/6sGXIHyG/egBxBqzh7uT7Y= X-Authority-Analysis: v=2.4 cv=Zsx4uN7G c=1 sm=1 tr=0 ts=6aab21b3 cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=VdqzKS8jKosA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=Y2IxJ9c9Rs8Kov3niI8_:22 a=VnNF1IyMAAAA:8 a=b_dQgyAL5RWhf91NP5kA:9 X-Proofpoint-ORIG-GUID: Zu2guZDqoAWmUqu9iTalyHmIe9n6-iUQ X-Proofpoint-GUID: Zu2guZDqoAWmUqu9iTalyHmIe9n6-iUQ X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-16_03,2026-09-16_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 impostorscore=0 clxscore=1015 priorityscore=1501 lowpriorityscore=0 bulkscore=0 adultscore=0 phishscore=0 spamscore=0 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609160322 Content-Type: text/plain; charset="utf-8" ibmvfc_tgt_implicit_logout_and_del() calls ibmvfc_set_tgt_action() with IBMVFC_TGT_ACTION_NONE in the NULL evt error path. However the state machine in ibmvfc_set_tgt_action() explicitly handles LOGOUT_RPORT and only permits transitions to LOGOUT_RPORT_WAIT or DEL_RPORT from that state; NONE is silently rejected and returns -EINVAL, leaving the target stuck in LOGOUT_RPORT. With the target permanently in LOGOUT_RPORT, ibmvfc_dev_logo_to_do() keeps returning 1, causing the host to spin in an infinite reset loop. Use IBMVFC_TGT_ACTION_DEL_RPORT instead, which is the same transition taken by the !vhost->logged_in early-exit path in the same function and is the correct valid transition to unblock target cleanup. Fixes: c8380c3ff651 ("ibmvfc: check for NULL evt in implicit LOGO and targe= t delete path") Signed-off-by: Tyrel Datwyler --- drivers/scsi/ibmvscsi/ibmvfc-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/scsi/ibmvscsi/ibmvfc-core.c b/drivers/scsi/ibmvscsi/ib= mvfc-core.c index 18e7a462e32d..e5eb0997d507 100644 --- a/drivers/scsi/ibmvscsi/ibmvfc-core.c +++ b/drivers/scsi/ibmvscsi/ibmvfc-core.c @@ -4542,7 +4542,7 @@ static void ibmvfc_tgt_implicit_logout_and_del(struct= ibmvfc_target *tgt) =20 if (!evt) { vhost->discovery_threads--; - ibmvfc_set_tgt_action(tgt, IBMVFC_TGT_ACTION_NONE); + ibmvfc_set_tgt_action(tgt, IBMVFC_TGT_ACTION_DEL_RPORT); kref_put(&tgt->kref, ibmvfc_release_tgt); __ibmvfc_reset_host(vhost); return; --=20 2.55.0 From nobody Fri Sep 25 04:07:46 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3C50E4CC261; Wed, 16 Sep 2026 23:09:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789600187; cv=none; b=q4+NnzQgw8a1BnQtjATy8eNV2goRdI/caate9GptBWylm7wem/kvQdXkhtwPRCNU9oyQi6pIEzJJAsL++frp3dqPh4TXvZcubjFBcK8VePqXEnlxHyKsF3p9uf5TIEZZWER4ohsS5/sAlHlMbo6iwjbuRti9RGnjRWSoNb2dqDo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789600187; c=relaxed/simple; bh=3dxEB8SrFmnwdPLfGRYnaacleG4TAQQvjT+bDXtu818=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=EDXmbu3XvWGq/8S+Gplixr4SMj8YNZheJDcWG7J1Y3RTx0eyaxVrdjGcQvFsMIvol4afYr8Qc/XRkWkAOuzLGF7nq88VUVwMyiWp5JYOZkwL+xq4jmGIz7yv16yD1nK+x0XeYNM5QOKSFlZqowd+TBV2AIj5vZC1Q2z23kGVDpk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=P89B/3vM; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="P89B/3vM" Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68GG1bqb018008; Wed, 16 Sep 2026 23:09:41 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=lBwV8ShGbU6TsAn5t w14ype6uEf1Oy80AzGpHyLl8lM=; b=P89B/3vMtqDvVKCLCAsHocvxoPvffCc+v 1tV628XpzaBKqzc9n4YdetMtjLInXk0RC6QfsSnrFcLcvLttBIi5TKRerRHI4rRh dlGklL2XMYoqJxfaepS97BjpCoTlgGYbXeEZgBsJgI+X9NF+dqTHrHOiPZP1kDPR yZB7yhKHz5rKvTalN2KT0ptboZTKy2EKId9Oa5AcsKSKLNbSZeEg3mES/8QGNKdw D8UG2IGqrJxI27yH2cj/QlEIe46uW/jsChAnKGdg96yhgyI0sbGHaNv29Z0kIvCc IalHeDWxkM3z8SlWbi6DYANcUiHe1KXszt5ksINX8/lRLFY3HCK7Q== Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gmxf57dx9-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Wed, 16 Sep 2026 23:09:40 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 68GN2TJw1625747; Wed, 16 Sep 2026 23:09:39 GMT Received: from smtprelay04.dal12v.mail.ibm.com ([172.16.1.6]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4gpyxsgw6t-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 16 Sep 2026 23:09:39 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay04.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 68GN9cJW26477190 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 16 Sep 2026 23:09:38 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 6A91158054; Wed, 16 Sep 2026 23:09:38 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 7B65D5804E; Wed, 16 Sep 2026 23:09:37 +0000 (GMT) Received: from li-4c4c4544-0054-3910-8039-c3c04f423534.ibm.com.com (unknown [9.61.141.190]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 16 Sep 2026 23:09:37 +0000 (GMT) From: Tyrel Datwyler To: james.bottomley@hansenpartnership.com, martin.petersen@oracle.com Cc: linux-scsi@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, brking@linux.ibm.com, davemarq@linux.ibm.com, Tyrel Datwyler Subject: [PATCH 10/20] scsi: ibmvfc: fix u16 overflow of max_cmds in ibmvfc_set_login_info() Date: Wed, 16 Sep 2026 16:09:11 -0700 Message-ID: <20260916230921.2204729-11-tyreld@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260916230921.2204729-1-tyreld@linux.ibm.com> References: <20260916230921.2204729-1-tyreld@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: 7CLJjdneXaOhQLDOvAicfUG-jAVeQh32 X-Proofpoint-Spam-Info: AW1haW4tMjYwOTE2MDMyMiBTYWx0ZWRfX1yKCmj4B5PVn m8zRz9xOHFh4O869R+Q4wupnSWDcMG4AQ4261PaaG05vY0C41AyHEUycj2INE4Dvzx4tr+m+lCM MIwDEaEIBcOhQCpj0GP+TanRrR7NyW0= X-Authority-Analysis: v=2.4 cv=cvgOAF4i c=1 sm=1 tr=0 ts=6aab21b4 cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=VdqzKS8jKosA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=U7nrCbtTmkRpXpFmAIza:22 a=VnNF1IyMAAAA:8 a=oS3JfTuPRayek_SdIqsA:9 X-Proofpoint-ORIG-GUID: 7CLJjdneXaOhQLDOvAicfUG-jAVeQh32 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTE2MDMyMiBTYWx0ZWRfX8yCpn8BkXgct 6DyXelqP0IogPPrymZtFGiB3+4+6LA3gr/2YgCki4Ha16Og4j8/NHDYhhea39+Xei7XUZTyyj8a 0/8M3mLf9gBLBoT3UL8PHRPmQIcduSEv3QYI0xDH/WLLBJoQ6ZtShdKGPtE1WbvePYjISteCn7f XyNzCozyyV/69BVNHxcej/aQ39MnKz4Tv3YJkqoYxrJ2LZXkMD/CbdHTJQoyLvCQ08UfkEQ4Og/ LFGX5Ah51CntZUNAtQCvNtXplGDxnTZXjH1+g4Kl8GIfDlf4szcmvOVL+PSdupJpcf28bc0RV7p XrQV205BdIt6CFCSySobA8GvVsO6r7wI/h8Eb+6lqW+6w1A9RArrepZtH5101x2KIzcNqiEaDv5 tQ49UwX6/fh9qOznMzvLXLLxuJc/zo/69q8+C+ZE1zkyDs9voplWj8jnJPMkNFupFWuwc7217cJ 5CeZoGhJXIUoUfnKQvg== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-16_03,2026-09-16_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 lowpriorityscore=0 clxscore=1015 priorityscore=1501 suspectscore=0 bulkscore=0 impostorscore=0 phishscore=0 spamscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609160322 Content-Type: text/plain; charset="utf-8" max_cmds is declared as u16 but the calculation: scsi_qdepth + IBMVFC_NUM_INTERNAL_REQ + (scsi_qdepth + IBMVFC_NUM_INTERNAL_SUBQ_REQ) * (scsi_scrqs.desired_queues + nvme_scrqs.desired_queues) can exceed 65535 at non-extreme configurations. With scsi_qdepth=3D2048 and 32 total desired queues (16 SCSI + 16 NVMe maximum), the subqueue term alone evaluates to 2052 * 32 =3D 65664, which silently wraps to 128 in a u16, causing the NPIV login MAD to advertise a badly corrupted command slot count to the VIOS. The wire field login_info->max_cmds is already __be32, so widen the local variable to u32 to match, making the arithmetic safe across all supported module parameter combinations. Fixes: bffd16f59061 ("ibmvfc: add logic for protocol specific fabric logins= ") Signed-off-by: Tyrel Datwyler --- drivers/scsi/ibmvscsi/ibmvfc-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/scsi/ibmvscsi/ibmvfc-core.c b/drivers/scsi/ibmvscsi/ib= mvfc-core.c index e5eb0997d507..e2f2fa42bcfd 100644 --- a/drivers/scsi/ibmvscsi/ibmvfc-core.c +++ b/drivers/scsi/ibmvscsi/ibmvfc-core.c @@ -1562,7 +1562,7 @@ static void ibmvfc_set_login_info(struct ibmvfc_host = *vhost) struct ibmvfc_queue *async_crq =3D &vhost->async_crq; struct device_node *of_node =3D vhost->dev->of_node; const char *location; - u16 max_cmds; + u32 max_cmds; =20 max_cmds =3D scsi_qdepth + IBMVFC_NUM_INTERNAL_REQ; if (mq_enabled) --=20 2.55.0 From nobody Fri Sep 25 04:07:46 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 76F9B4DB540; Wed, 16 Sep 2026 23:09:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789600189; cv=none; b=qtprnTVuv6t1WnSi/HZgLO0L3jU1aLVMoAykAknb4vxsVDWwBszayv6x21GR8YIXXtnC6e9docckmn+5UnQaCkS2I0WmGKdWYakXnPdltc/u992PiRNUHGNcvQr9baG9eqchmRJ7vcRLip6p60dtpIHyUJEZ6tIcLyIl2OMiVmM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789600189; c=relaxed/simple; bh=ID9jfRjkA1dJd83/4oXkUhAjDWi3Oq+nCINarJ7veXo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=hnscWwKs/2Xa5y30Ald31LCb85FMFSzoQMI01TsgxPoDGR4rwp1Hnr2PCF5sUyOEODKbDhHEBRN6XAEtZQBVGY8ThVSmjPX/D3zS5iM3r+OJxTYtkcCSvz4bKOhz15jjh1R//Ri9g4EuopdVF/MZldnaaIkNeBeFu+05KXq7d00= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=jGHFSZHs; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="jGHFSZHs" Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68GG1Vs9006704; Wed, 16 Sep 2026 23:09:42 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=pp1; bh=rRGClm LfdI+ky+NkVLKwrOC8+1UKQ5lurLYhttbQnyU=; b=jGHFSZHs7YAPzQBZOQrrLe IiPAzt3/s6udLiJ/rMpAklqxROGwp6Uu4v264xKMLqRjD+rY8quR+FABIbOnwKwP 2jsO4urD+dGOb+kRbGypsxu92m0w/LDT66VGrL0kDZcAZfC32UBzw7Ixgxii/dia fZnK/HKqvAC2XepoQ8cSmBe3LRg1+K2W+cnOZ2MIF8mjvJCOo9mPr1Y+o58F8WlP zXrwp7MxSgPm09NuVeIcCbTl662eEFhOxwk++ud1+u/x+UVXxKfplUf61kl0/J2j lOyqPXAfx+vWREMsl8tg55C9jbfqn8RiepQCYv3XWStgrJZz/tAiuL+vGvS0JNZw == Received: from ppma23.wdc07v.mail.ibm.com (5d.69.3da9.ip4.static.sl-reverse.com [169.61.105.93]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gmx83ydyr-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Wed, 16 Sep 2026 23:09:41 +0000 (GMT) Received: from pps.filterd (ppma23.wdc07v.mail.ibm.com [127.0.0.1]) by ppma23.wdc07v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 68GMnhpK1663474; Wed, 16 Sep 2026 23:09:41 GMT Received: from smtprelay05.dal12v.mail.ibm.com ([172.16.1.7]) by ppma23.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4gq089rtjc-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 16 Sep 2026 23:09:41 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay05.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 68GN9dl932899816 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 16 Sep 2026 23:09:40 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 8EBBF58054; Wed, 16 Sep 2026 23:09:39 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 991B75804E; Wed, 16 Sep 2026 23:09:38 +0000 (GMT) Received: from li-4c4c4544-0054-3910-8039-c3c04f423534.ibm.com.com (unknown [9.61.141.190]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 16 Sep 2026 23:09:38 +0000 (GMT) From: Tyrel Datwyler To: james.bottomley@hansenpartnership.com, martin.petersen@oracle.com Cc: linux-scsi@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, brking@linux.ibm.com, davemarq@linux.ibm.com, Tyrel Datwyler Subject: [PATCH 11/20] scsi: ibmvfc: fix UAF and hang in ibmvfc_cancel_all_mq() on send failure Date: Wed, 16 Sep 2026 16:09:12 -0700 Message-ID: <20260916230921.2204729-12-tyreld@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260916230921.2204729-1-tyreld@linux.ibm.com> References: <20260916230921.2204729-1-tyreld@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTE2MDMyMiBTYWx0ZWRfXyEJM+q/jKb0r KvsOqEXPKlDXQDhnDnjKkwrxAwExEs/s+6u/XSqpb+yTDSXNVljorO/65SB0LOwbOmEELOSlivO zeW+Jg7KSPbq9epw2QKX95an4KSDUemQL28V5kHaDwaDsWW+M52JGdzvDh6M/sRDiwbQrSNNpHG cUZgWS1Aqns+4TP0BCkE8j6oxePLNG53RiA6YT3KKGpl66O+yWtUOWSC8l+eZsTCWI9PDcT2dJK ICG/vIRB9/4FbgZXep6w5XQjUjUdO1JZQbP25q3IZPqoOw+/Xblvzo2Ewv893VtZbQffkTuoHPE SDQ3M3lqPJK+MjwRdXocvhfixzdzMTObA4nOCOSU2xuzgnVzFos0mx3YXdiRQY1SvnXVtbxKwDA UP7m9qoRqj2PbFLKkSiqQduyXnNPchnji45+yRFsLb0wfmxyTkwvXARmX1E6rWML8ndzwvsVPp7 R5jnACvcz8Wi//Wg6og== X-Proofpoint-ORIG-GUID: aMA0zyScOwWsNfQb8P309C9tiAJR1otE X-Proofpoint-GUID: aMA0zyScOwWsNfQb8P309C9tiAJR1otE X-Proofpoint-Spam-Info: AW1haW4tMjYwOTE2MDMyMiBTYWx0ZWRfX9cBjh0rYhyQ+ 0Wmc5cD5Y56FN9JKz9FWyJrbCypnx0bBdZDGMoLyzCNcvZl6MSAjpm3ulnhnYHEtIKMbomVUOuF AlH3BZVqXNRsb7HQznvUK9pO4B5BNHs= X-Authority-Analysis: v=2.4 cv=cY9HPXDM c=1 sm=1 tr=0 ts=6aab21b6 cx=c_pps a=3Bg1Hr4SwmMryq2xdFQyZA==:117 a=3Bg1Hr4SwmMryq2xdFQyZA==:17 a=IkcTkHD0fZMA:10 a=VdqzKS8jKosA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=iQ6ETzBq9ecOQQE5vZCe:22 a=VnNF1IyMAAAA:8 a=nlcoev9x_0hUi8ert_4A:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-16_03,2026-09-16_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 spamscore=0 bulkscore=0 clxscore=1015 suspectscore=0 impostorscore=0 malwarescore=0 phishscore=0 adultscore=0 lowpriorityscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609160322 ibmvfc_cancel_all_mq() discards the return value of ibmvfc_send_event(). When ibmvfc_send_event() fails due to H_CLOSED it internally frees the event before returning SCSI_MLQUEUE_HOST_BUSY. The caller then performs list_add_tail() on the freed event =E2=80=94 a use-after-free =E2=80=94 and= subsequently blocks indefinitely on wait_for_completion(&evt->comp) for a completion that will never arrive. Fix by capturing the return value. On failure, drop the locks, log the error (consistent with ibmvfc_cancel_all_sq()), drain and free any cancel events already queued from earlier loop iterations, then return 0. Returning 0 on send failure is correct: when the adapter closes the CRQ the firmware delivers a transport event through ibmvfc_handle_crq() which completes all outstanding commands, so the error recovery caller will naturally see them return. Fixes: 5ca8f4e826ff ("ibmvfc: don't call locked done variant for MADs on se= nd failure") Signed-off-by: Tyrel Datwyler --- drivers/scsi/ibmvscsi/ibmvfc-core.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/ibmvscsi/ibmvfc-core.c b/drivers/scsi/ibmvscsi/ib= mvfc-core.c index e2f2fa42bcfd..190410847efb 100644 --- a/drivers/scsi/ibmvscsi/ibmvfc-core.c +++ b/drivers/scsi/ibmvscsi/ibmvfc-core.c @@ -2693,6 +2693,7 @@ static int ibmvfc_cancel_all_mq(struct scsi_device *s= dev, int type) unsigned long flags; int num_hwq, i; int fail =3D 0; + int rc; LIST_HEAD(cancelq); u16 status; =20 @@ -2719,7 +2720,18 @@ static int ibmvfc_cancel_all_mq(struct scsi_device *= sdev, int type) return -ENOMEM; } evt->sync_iu =3D &queues[i].cancel_rsp; - ibmvfc_send_event(evt, vhost, default_timeout); + rc =3D ibmvfc_send_event(evt, vhost, default_timeout); + if (rc) { + spin_unlock(queues[i].q_lock); + spin_unlock_irqrestore(&vhost->host->host_lock, flags); + sdev_printk(KERN_ERR, sdev, "Failed to send cancel event. rc=3D%d\n", = rc); + list_for_each_entry_safe(evt, temp, &cancelq, cancel) { + wait_for_completion(&evt->comp); + list_del(&evt->cancel); + ibmvfc_free_event(evt); + } + return 0; + } list_add_tail(&evt->cancel, &cancelq); } =20 --=20 2.55.0 From nobody Fri Sep 25 04:07:46 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E84F94D2ED3; Wed, 16 Sep 2026 23:09:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789600189; cv=none; b=RlEnAOLUU87qQI/Bj9HWuXI9WKHIQeUwUzpPEtdVByxMQ9O+fxAE+Tvb+WRC6wuBeFNNmSE+UgtLBYFxvTzo1gC115HpsnT26Sv9vNYDLzGNceWXcmJEubpiLvgm8y3Yy2C5V8aMkkfD/MULybPM3uuUz/4iQtms6pTkcrKBJJA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789600189; c=relaxed/simple; bh=QLHsUXqM9vwACQY9WbAi62rdPJpF6koQoxLjZ+p2NpM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Ccrz9jtxgvmG0wMicgna3e0pCkkuF9LYrFXTY6bOApgkCBJmWJtiL6hplgSC0KgX6k4EvRkwU6DUIT32EK35acWXTI8PPaWRWA05qchUCh3c9+JUPS/UlqCA/0CJ5P6ndLJH4UY7iu1j8Xoi8bmSVdcvjn8ofrmIoAkczMcC5wQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=SGC2Nhkj; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="SGC2Nhkj" Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68GG1cui3041282; Wed, 16 Sep 2026 23:09:42 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=lz9ly8gVAyNDFvujV Nl5Lid0gT/rZwvTUjaa6S5a1Wg=; b=SGC2NhkjrFnzYLhrVSH4GsuLv3s/kLgZk ulzuFdDx+TVSWzq7jIStQsVTf3gCa6IOji8Euoq5sZot43h/6RXjUK6v+mzRCGU7 8Bv6wOnt6fMmjv6sIVSi8ROAwXrb8B0bxKq+5rXJGve644KoZ4y4jleQj4mQeEbS 2NfkMxSjAnWZpJZOawt966mVI0+t2IeW6abtoQD1tdfS+J4d1EYoyJvij0xQPlYa 174g7vdg7vOSgpBTymRdvauXOFF7mWTJNQb2m1tYu7tLJObke28Elb8a6eaEfQfm CUFz1TQYIPU7Zcgx1CYHBQXQpFv3JOuzIU9l0Lwhc12EfUDEviOPg== Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gmw5e73jn-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Wed, 16 Sep 2026 23:09:42 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 68GMub101625387; Wed, 16 Sep 2026 23:09:42 GMT Received: from smtprelay06.dal12v.mail.ibm.com ([172.16.1.8]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4gpyxsgw72-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 16 Sep 2026 23:09:42 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay06.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 68GN9eSm29229776 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 16 Sep 2026 23:09:41 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id AFA4458056; Wed, 16 Sep 2026 23:09:40 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id BB6E058064; Wed, 16 Sep 2026 23:09:39 +0000 (GMT) Received: from li-4c4c4544-0054-3910-8039-c3c04f423534.ibm.com.com (unknown [9.61.141.190]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 16 Sep 2026 23:09:39 +0000 (GMT) From: Tyrel Datwyler To: james.bottomley@hansenpartnership.com, martin.petersen@oracle.com Cc: linux-scsi@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, brking@linux.ibm.com, davemarq@linux.ibm.com, Tyrel Datwyler Subject: [PATCH 12/20] scsi: ibmvfc: fix data race on tgt->nvme_remote_port Date: Wed, 16 Sep 2026 16:09:13 -0700 Message-ID: <20260916230921.2204729-13-tyreld@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260916230921.2204729-1-tyreld@linux.ibm.com> References: <20260916230921.2204729-1-tyreld@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTE2MDMyMiBTYWx0ZWRfX7g2zcNPj3kIz apkQxaYyKRT9TjG8nu6+rQymn99V6r84d9+A31hxinyE70XP4mI1EG6SsgxwaPX1Xuzdaiu+Vba iR2jCDMjkw8RnCmNLJTEcb/uHucL8e7CoSJU2nh9xLnTvIwYWNzH/QnnKa3aRCV5+v3Cfh6Ywn4 6VVuW+Z6gd3+R/CociMcUhfGIDCrhbDpa5HdMSHFpRKKTR3bfdm6dULJbQueGC7aXjYpU2vDeKj oAb8wVcaLSZC5cTVpsOVdnbraWFFcF9n5ch8akhD6QgJ7BYCyaeOrIkm/te8VydJoMnZ942PyCo V5gACu8dsCa0KXfrrJJ2Uf6BnPxAI0s6ZhvSqewcX2j+7oZ4eNef55U1ywMY9qRcuwDivraHFQv VGMx1Wt1gttwC6KtXl8YahxLb9a3z+jewBHhIx6STEf9BldXkwOsysmkyHu7nZgJwnChzohwRLn SrLKPkpzl2CZpxWOe/Q== X-Authority-Analysis: v=2.4 cv=E/NYNqdl c=1 sm=1 tr=0 ts=6aab21b6 cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=VdqzKS8jKosA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=VnNF1IyMAAAA:8 a=J1oym3C9a2iPP8IqlnUA:9 X-Proofpoint-ORIG-GUID: LhIRzOGqQl8No8OluDWtJb67UTx3gVSw X-Proofpoint-Spam-Info: AW1haW4tMjYwOTE2MDMyMiBTYWx0ZWRfXxNjpU8pdZIcl 4CU9DhpylhGdHDms/RydYkN9FhTTOPw8MzUkvnYOProt/dPu5Z3lDNJzDgfE3pBiVLZ//kRX8f9 1QItLP6X7MiM81BGKjwPjAgRSp2+0Sg= X-Proofpoint-GUID: LhIRzOGqQl8No8OluDWtJb67UTx3gVSw X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-16_03,2026-09-16_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 lowpriorityscore=0 priorityscore=1501 spamscore=0 adultscore=0 clxscore=1015 bulkscore=0 malwarescore=0 suspectscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609160322 Content-Type: text/plain; charset="utf-8" tgt->nvme_remote_port is written in two places without holding host_lock: 1. ibmvfc_nvme_register_remoteport() calls nvme_fc_register_remoteport() and stores the result directly into tgt->nvme_remote_port with no lock held, racing against locked readers in ibmvfc_tgt_add_nvme_rport() and ibmvfc_do_work(). 2. The ibmvfc_nvme_remoteport_delete() callback writes tgt->nvme_remote_port =3D NULL from the NVMe core's thread context with no lock held, again racing against every locked reader of the field. All readers of tgt->nvme_remote_port acquire host_lock before reading the field, so both writers must do the same. For ibmvfc_nvme_register_remoteport(): nvme_fc_register_remoteport() may sleep so it must be called before acquiring the spinlock. Use a local pointer to capture the result, then take host_lock and store the pointer into tgt->nvme_remote_port and set ->private under the lock. For ibmvfc_nvme_remoteport_delete(): acquire host_lock around the tgt->nvme_remote_port =3D NULL store. The callback is always invoked after ibmvfc_nvme_unregister_remoteport() drops host_lock before waiting for completion, so taking the lock here is safe. Fixes: 696d1cc2aaa2 ("scsi: ibmvfc: process NVMe/FC rports in work thread") Signed-off-by: Tyrel Datwyler --- drivers/scsi/ibmvscsi/ibmvfc-nvme.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/drivers/scsi/ibmvscsi/ibmvfc-nvme.c b/drivers/scsi/ibmvscsi/ib= mvfc-nvme.c index 7fdf27fbe7e7..d9f280c658eb 100644 --- a/drivers/scsi/ibmvscsi/ibmvfc-nvme.c +++ b/drivers/scsi/ibmvscsi/ibmvfc-nvme.c @@ -26,8 +26,11 @@ static void ibmvfc_nvme_localport_delete(struct nvme_fc_= local_port *lport) static void ibmvfc_nvme_remoteport_delete(struct nvme_fc_remote_port *rpor= t) { struct ibmvfc_target *tgt =3D rport->private; + unsigned long flags; =20 + spin_lock_irqsave(&tgt->vhost->host->host_lock, flags); tgt->nvme_remote_port =3D NULL; + spin_unlock_irqrestore(&tgt->vhost->host->host_lock, flags); complete(&tgt->nvme_delete_done); } =20 @@ -469,7 +472,9 @@ static struct nvme_fc_port_template ibmvfc_nvme_fc_tran= sport =3D { int ibmvfc_nvme_register_remoteport(struct ibmvfc_target *tgt) { struct ibmvfc_host *vhost =3D tgt->vhost; + struct nvme_fc_remote_port *rport; struct nvme_fc_port_info pinfo; + unsigned long flags; int rc; =20 if (!IS_ENABLED(CONFIG_NVME_FC)) @@ -486,14 +491,16 @@ int ibmvfc_nvme_register_remoteport(struct ibmvfc_tar= get *tgt) pinfo.port_id =3D tgt->ids.port_id; pinfo.port_role =3D FC_PORT_ROLE_NVME_TARGET; =20 - rc =3D nvme_fc_register_remoteport(vhost->nvme_local_port, &pinfo, - &tgt->nvme_remote_port); + rc =3D nvme_fc_register_remoteport(vhost->nvme_local_port, &pinfo, &rport= ); =20 + spin_lock_irqsave(&vhost->host->host_lock, flags); if (!rc) { ibmvfc_log(vhost, 2, "register_remoteport: traddr=3Dnn-0x%llx:pn-0x%llx = PortID:%x\n", pinfo.node_name, pinfo.port_name, pinfo.port_id); - tgt->nvme_remote_port->private =3D tgt; + rport->private =3D tgt; + tgt->nvme_remote_port =3D rport; } + spin_unlock_irqrestore(&vhost->host->host_lock, flags); =20 return rc; } --=20 2.55.0 From nobody Fri Sep 25 04:07:46 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 942A64CDA39; Wed, 16 Sep 2026 23:09:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789600191; cv=none; b=NxfLrca7zJq84hX9tCYmUu+PQsDhwHtB7tYU3CnoWvO1WD7Sals4z4u5+WAsrJKsyuWcibFUdfsYIu4eFs6J770+VZ155FfCg/bIeiLIXdpE9mocMHtkEwRcHD7tc09nalTdOkCKYiQAhUHypW+MReZPmXWNDQFCQLC2qeO29Ng= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789600191; c=relaxed/simple; bh=/9sBlz23bAELsYD4zWmjO4Ay4e7cNSA2tokuQ6fdeKk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=S5qoK+MC8etpT3xNqNmtbv6mF/Ez2OTXv0R3hb8tOs3FpRTtVqIHZ/iwnpbHyL37vAHry6ftwqRcTzLqUdXbNiVoUBNsxsxYLG+wy7SXsPxGJVWXcPB64JiHuQWtV65hT+oB0xI0PL5HOQ8QyPESwCoIXFvwhm6oDmkVLBMDPEY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=VanvMmMa; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="VanvMmMa" Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68GG1bB14057197; Wed, 16 Sep 2026 23:09:44 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=vrNNndpg8uDbPLoZ8 wG5Yom8DF08eKhsLkkfjMxG7uk=; b=VanvMmMa/u5bph2/vtZDmPsZpVBqBrObc 6nNcvu2sJvWu/RKHVgHMqk2spO57ax/552Wqi3eQzuGEIlSD381+uxl7bObTaSYt 201EEgyVYhWCseim1lQPiwLyjvbE1SH4Z5UQZN6OWfxfrizw9asFCWIjhd/RlFKN D59WWBfs9/TxdxM0OmrgSQuSALQgFrtTW8hyI6MniS8689ujRmFjVTmp+VtEZidy Qii4rCFX8KbIfRGDt1Ad0oV7H6NKxN4GwrQu5a6QqxfMJQ/DEbhFCLMj3p670oJ1 iImprXTqY+lZ3bpk2+zPb7rLQqeKSIo7YGbvvjsQxMhP4xeQ5UGgQ== Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gmv5hy9vc-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Wed, 16 Sep 2026 23:09:43 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 68GMqn6e1713205; Wed, 16 Sep 2026 23:09:43 GMT Received: from smtprelay07.dal12v.mail.ibm.com ([172.16.1.9]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4gpywf0w4y-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 16 Sep 2026 23:09:43 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay07.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 68GN9fFN12321386 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 16 Sep 2026 23:09:42 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id CA47358056; Wed, 16 Sep 2026 23:09:41 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id DD48458054; Wed, 16 Sep 2026 23:09:40 +0000 (GMT) Received: from li-4c4c4544-0054-3910-8039-c3c04f423534.ibm.com.com (unknown [9.61.141.190]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 16 Sep 2026 23:09:40 +0000 (GMT) From: Tyrel Datwyler To: james.bottomley@hansenpartnership.com, martin.petersen@oracle.com Cc: linux-scsi@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, brking@linux.ibm.com, davemarq@linux.ibm.com, Tyrel Datwyler Subject: [PATCH 13/20] scsi: ibmvfc: make NVMe FCP abort callback asynchronous Date: Wed, 16 Sep 2026 16:09:14 -0700 Message-ID: <20260916230921.2204729-14-tyreld@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260916230921.2204729-1-tyreld@linux.ibm.com> References: <20260916230921.2204729-1-tyreld@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTE2MDMyMiBTYWx0ZWRfX8cvTC+XuKLgE zLapWam3bdzQcqpx2hTQ/4GOFMa6zWJbxXBpLoLJde2Weqs0KHXS/ZUFxMyU0jWEmK4Rg8zYAJ4 Lktngr02mD3RoXEA+E1+gZs4ePt4BUihYTG15YApfaojfA0FVZsuxy5p9gSIYvp0U56nq6e8eM/ p8Wy5XM1JB31pW8SgPv+JO54M073pGiPkJT/uk4MPTLK+B9dwUU3OUYkhwflj8BLpEaiVI1YeQC Rs25YaMPNK4Kpe4YUctG092sQsuCHqeLjOgzZDRaqCM6NHzWP/T2o8H8502Qbp0Rdr4ME97R40/ hP8x8+ubWrmLHdBfwMe1Hymz+XJ8UjMjOX+O15TNREFjIF4Au1A4Uv97xjsEmUXN0mSsMXhwcdF d7w/wKJxfZFI2i1OtCFof9aPpxKuuCRiU3lCQEz9bhk6p9cOOOi+r5W0DbIIUCVmA1k9sBiy9lK anhn/yuZzA0pe4/MOKA== X-Proofpoint-Spam-Info: AW1haW4tMjYwOTE2MDMyMiBTYWx0ZWRfXyPbCyAs7HPX2 XX0QSQh3sWB8ftPSL9kN2/aUuE1+6PN+Nhj2QEftjY5yE5HycIlFAiBeKagEaA93oXm26CyNh3u +J2uUNT6Op1sWI+QCsG0EL3WnopDRNg= X-Authority-Analysis: v=2.4 cv=Zsx4uN7G c=1 sm=1 tr=0 ts=6aab21b7 cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=VdqzKS8jKosA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=Y2IxJ9c9Rs8Kov3niI8_:22 a=VnNF1IyMAAAA:8 a=bHZ0--RjxAHeecJfWq4A:9 X-Proofpoint-ORIG-GUID: MRfKdFncXLRnA9CZQ_gWCq-OWtpjGDgh X-Proofpoint-GUID: MRfKdFncXLRnA9CZQ_gWCq-OWtpjGDgh X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-16_03,2026-09-16_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 impostorscore=0 clxscore=1015 priorityscore=1501 lowpriorityscore=0 bulkscore=0 adultscore=0 phishscore=0 spamscore=0 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609160322 Content-Type: text/plain; charset="utf-8" The nvme_fc_port_template fcp_abort callback is called by the NVMe-FC transport from the block layer timeout workqueue. The current implementation submits a cancel MAD and then blocks on wait_for_completion() until the VIOS response arrives. This stalls the timeout workqueue for the full MAD round-trip, preventing any other I/O timeout from being processed in the meantime. The nvme-fc-driver.h API contract is explicit: the LLDD must initiate the abort and return immediately; the ABTS does not need to be complete on return. The transport waits for the original exchange to complete independently via fcp_req->done(). Replace the synchronous ibmvfc_sync_nvme_completion callback with a dedicated ibmvfc_nvme_fcp_abort_done() that runs asynchronously when the cancel MAD response arrives. The new callback logs any non-zero MAD status, drops the target kref, and frees the event. ibmvfc_send_event() guarantees the done callback is invoked on both success and failure paths, so event ownership is fully transferred and ibmvfc_nvme_fcp_abort() returns immediately after ibmvfc_send_event(). Drop the now-unnecessary init_completion() from ibmvfc_init_fcp_abort() and the sync_iu / wait_for_completion / second lock-cycle from the abort function itself. Fixes: 4e70b8795ee3 ("scsi: ibmvfc: implement nvme-fc FCP abort callback") Signed-off-by: Tyrel Datwyler --- drivers/scsi/ibmvscsi/ibmvfc-nvme.c | 35 ++++++++++++----------------- 1 file changed, 14 insertions(+), 21 deletions(-) diff --git a/drivers/scsi/ibmvscsi/ibmvfc-nvme.c b/drivers/scsi/ibmvscsi/ib= mvfc-nvme.c index d9f280c658eb..52e2621a4342 100644 --- a/drivers/scsi/ibmvscsi/ibmvfc-nvme.c +++ b/drivers/scsi/ibmvscsi/ibmvfc-nvme.c @@ -396,8 +396,18 @@ static void ibmvfc_init_fcp_abort(struct ibmvfc_event = *evt, tmf->target_wwpn =3D cpu_to_be64(tgt->wwpn); tmf->assoc_id =3D cpu_to_be64(tgt->assoc_id); tmf->task_tag =3D cpu_to_be64((u64)abt_evt); +} =20 - init_completion(&evt->comp); +static void ibmvfc_nvme_fcp_abort_done(struct ibmvfc_event *evt) +{ + u16 status =3D be16_to_cpu(evt->xfer_iu->mad_common.status); + + if (status) + ibmvfc_dbg(evt->vhost, "fcp_abort: cancel MAD failed with rc=3D%x\n", + status); + + kref_put(&evt->tgt->kref, ibmvfc_release_tgt); + ibmvfc_free_event(evt); } =20 static void ibmvfc_nvme_fcp_abort(struct nvme_fc_local_port *lport, @@ -409,9 +419,7 @@ static void ibmvfc_nvme_fcp_abort(struct nvme_fc_local_= port *lport, struct ibmvfc_target *tgt =3D rport->private; struct ibmvfc_event *evt, *abt_evt =3D abort_req->private; struct ibmvfc_queue *queue; - union ibmvfc_iu rsp; unsigned long flags; - u16 status =3D 0; =20 if (!abt_evt) return; @@ -426,27 +434,12 @@ static void ibmvfc_nvme_fcp_abort(struct nvme_fc_loca= l_port *lport, =20 spin_lock_irqsave(queue->q_lock, flags); kref_get(&tgt->kref); - ibmvfc_init_event(evt, ibmvfc_sync_nvme_completion, IBMVFC_MAD_FORMAT); + ibmvfc_init_event(evt, ibmvfc_nvme_fcp_abort_done, IBMVFC_MAD_FORMAT); ibmvfc_init_fcp_abort(evt, abort_req); - evt->sync_iu =3D &rsp; - - if (ibmvfc_send_event(evt, vhost, default_timeout)) - goto out; + evt->tgt =3D tgt; =20 + ibmvfc_send_event(evt, vhost, default_timeout); spin_unlock_irqrestore(queue->q_lock, flags); - - wait_for_completion(&evt->comp); - status =3D be16_to_cpu(rsp.mad_common.status); - - spin_lock_irqsave(queue->q_lock, flags); - ibmvfc_free_event(evt); -out: - spin_unlock_irqrestore(queue->q_lock, flags); - - if (status) - ibmvfc_dbg(vhost, "fcp_abort: cancel failed with rc=3D%x\n", status); - - kref_put(&tgt->kref, ibmvfc_release_tgt); } =20 static struct nvme_fc_port_template ibmvfc_nvme_fc_transport =3D { --=20 2.55.0 From nobody Fri Sep 25 04:07:46 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1659C4DF4C1; Wed, 16 Sep 2026 23:09:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789600193; cv=none; b=MIiPxN7GJFMDXq7k4DZNrh5fYjGfRQfwwwmh2YZ2z2kBXNpWoVHu5h6PrMSmH2AbqNzcDw9ranrY4vR4wVQbO9s1JZBlXaWsUTVHjPjRmDzvaGQ8PIBUQypIKpMKSBpK07ka+m2kfgXHakBRKu4ToPb/6TgaMWWcF46xS7W9tyw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789600193; c=relaxed/simple; bh=BKzJNtbcpl7AWuskcHlS/q1zvEjlIf1PkHugFLftmnM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=XhdXuSFM9gh8uBrnnaWSmyBL1OrQZncgjR7EYsPlMfimQQAoWOJC/5N7NlmxJmDlbWZapRPhinTlGvgiKWe+0DeV3K0dXGVTd6jLssai9bEivyz4kcWhL+3SX3i3ZImjL3QPG2ONRaq70YYOW8vY8iYBE3DVMmPfeZj2IuZ43hI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=hZtm0kAo; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="hZtm0kAo" Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68GG1Vl3006701; Wed, 16 Sep 2026 23:09:45 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=EEuEuE0WYF2hGja20 dAtbb6NKs9VnDwccw2Va5YMUlo=; b=hZtm0kAokL+N/JSUNOCvmMOpPLdVKsLxT 46U/PHi0vOc/msxZpyQ0pQxwdBJHqcL3KI4I13YbSe8vI/TBQVs9+eb+B1Uw2vfV KsxDsQEswML/nDG1WBKX9qqnOcmhqoro6RoTKRqPQAArIohPyVfBxybjwFTEE3ZJ fvwe7iC2hRo63QITNBtDQyaA20w1EbvU+Krv61bcr/60JNGK0VcCg/7aqhXHvlEV P7p5/206i9oMoySm4NjyRxFlfT+/clJFToPVqr8Jtpt7gEJ/HdTTkovugEtoDBCt AgaYudb7tU6qjeX+WKsEdY+NklCfhUJIfT6ZiW0RoS9vS3GYx+H7g== Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gmx83ydyt-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Wed, 16 Sep 2026 23:09:45 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 68GN2IAU1699595; Wed, 16 Sep 2026 23:09:44 GMT Received: from smtprelay01.wdc07v.mail.ibm.com ([172.16.1.68]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 4gq03vgufr-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 16 Sep 2026 23:09:44 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay01.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 68GN9heq4719444 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 16 Sep 2026 23:09:43 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id E39CC5804E; Wed, 16 Sep 2026 23:09:42 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 0358458066; Wed, 16 Sep 2026 23:09:42 +0000 (GMT) Received: from li-4c4c4544-0054-3910-8039-c3c04f423534.ibm.com.com (unknown [9.61.141.190]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 16 Sep 2026 23:09:41 +0000 (GMT) From: Tyrel Datwyler To: james.bottomley@hansenpartnership.com, martin.petersen@oracle.com Cc: linux-scsi@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, brking@linux.ibm.com, davemarq@linux.ibm.com, Tyrel Datwyler Subject: [PATCH 14/20] scsi: ibmvfc: fix UAF and stall in NVMe LS abort callback Date: Wed, 16 Sep 2026 16:09:15 -0700 Message-ID: <20260916230921.2204729-15-tyreld@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260916230921.2204729-1-tyreld@linux.ibm.com> References: <20260916230921.2204729-1-tyreld@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTE2MDMyMiBTYWx0ZWRfXxvRt7LLxO4fk oCNxB0/HcNk6V6sUoRiJFVm5xuKjcGXheCr4GxsNb02RVlTE+i2YRFjjBfajrXWiStDdbTOthiP Tewr4squ1SJyajKAXKCq0+2Ca3VyPYwup0BRArGYG61Hj6b3wvbP4TK36QFSC8wpFtDG4yy4vZV ravlV47TQpEwynOLhVkcvJcxC2WuUXJUb2Is2F7iYhU6uiinlFvT9/OxsoebPHwyML8nxjBwBO4 SpBU2PdjDp74DDKpj6D3a5MvdQER6P6T62Ov/XMGXLT9Jeqpp5r+/yDHPgFJyY2V1ELKwgd+pN4 3j154SzZgLg3jJr1Z9GSB4gli+Hdt/7Wt2FYo5x8Yg+TxbT4I5ZiOSbV2dD45oVABmW/ho21Ibu 0tBHNyOB1rI3SzP1HfQgoMI2Du+3vNqZAIj5+9HR1Uo/CDl9fl0Q6rGoAFK7aJcCMvnAqe5CLia hx756L4wcsAG1EIrjKw== X-Proofpoint-ORIG-GUID: YSDbtv1x8s2r3nj-LMWiwgUn8DGl6t2m X-Proofpoint-GUID: YSDbtv1x8s2r3nj-LMWiwgUn8DGl6t2m X-Proofpoint-Spam-Info: AW1haW4tMjYwOTE2MDMyMiBTYWx0ZWRfX014pdk1roAkM lpV/Cq67rx1VRnlXwCggeXNazBgMgw1/mqgcB5GCCncyM3ShxTxAbdX2xjTgzmCVwyOZCldIx7k nud+MSxaaQHLgjsKPIjTl0O7kLNDlTg= X-Authority-Analysis: v=2.4 cv=cY9HPXDM c=1 sm=1 tr=0 ts=6aab21b9 cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=VdqzKS8jKosA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=iQ6ETzBq9ecOQQE5vZCe:22 a=VnNF1IyMAAAA:8 a=bf3VTdwimHnaYT9JOUcA:9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-16_03,2026-09-16_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 spamscore=0 bulkscore=0 clxscore=1015 suspectscore=0 impostorscore=0 malwarescore=0 phishscore=0 adultscore=0 lowpriorityscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609160322 Content-Type: text/plain; charset="utf-8" Two problems in ibmvfc_nvme_ls_abort(): 1. Use-after-free / stale pointer dereference. ibmvfc_init_ls_abort() reads abt_evt =3D ls_abort->private and immediately dereferences abt_evt->tgt. ibmvfc_ls_req_done() calls ibmvfc_free_event() under host_lock, which returns the event slot to the pool. If the LS completes naturally just before ls_abort is called, abt_evt points to a freed (and potentially reused) event, making the dereference a UAF. Fix by taking host_lock before reading ls_abort->private and checking evt->free (set to 1 by ibmvfc_free_event() under host_lock) to detect whether the original LS has already completed. If so, there is nothing to cancel and we return early. ibmvfc_get_event() is also moved inside the lock so the validity check and event allocation are atomic with respect to the completion path. 2. Blocking wait on timeout workqueue (same class as the FCP abort fix). The original code called wait_for_completion() from ls_abort, which is invoked by the NVMe-FC transport from a context that must not block. Fix by replacing ibmvfc_sync_nvme_completion with a dedicated async callback ibmvfc_nvme_ls_abort_done() that logs any non-zero MAD status, drops the target kref, and frees the event. ibmvfc_send_event() guarantees the callback fires on both success and failure paths, so ibmvfc_nvme_ls_abort() returns immediately after ibmvfc_send_event(). ibmvfc_sync_nvme_completion is now unused and is removed. ibmvfc_init_ls_abort() is updated to take the validated abt_evt pointer directly instead of deriving it from ls_abort->private. Fixes: 20bec08f0208 ("scsi: ibmvfc: implement nvme-fc LS abort handling cal= lback") Signed-off-by: Tyrel Datwyler --- drivers/scsi/ibmvscsi/ibmvfc-nvme.c | 68 +++++++++++++++-------------- 1 file changed, 35 insertions(+), 33 deletions(-) diff --git a/drivers/scsi/ibmvscsi/ibmvfc-nvme.c b/drivers/scsi/ibmvscsi/ib= mvfc-nvme.c index 52e2621a4342..7e18b79ae4cc 100644 --- a/drivers/scsi/ibmvscsi/ibmvfc-nvme.c +++ b/drivers/scsi/ibmvscsi/ibmvfc-nvme.c @@ -164,21 +164,12 @@ static int ibmvfc_nvme_ls_req(struct nvme_fc_local_po= rt *lport, return 0; } =20 -static void ibmvfc_sync_nvme_completion(struct ibmvfc_event *evt) +static void ibmvfc_init_ls_abort(struct ibmvfc_event *evt, + struct ibmvfc_event *abt_evt) { - /* copy the response back */ - if (evt->sync_iu) - *evt->sync_iu =3D *evt->xfer_iu; - - complete(&evt->comp); -} - -static void ibmvfc_init_ls_abort(struct ibmvfc_event *evt, struct nvmefc_l= s_req *ls_abort) -{ - struct ibmvfc_tmf *tmf; - struct ibmvfc_event *abt_evt =3D ls_abort->private; struct ibmvfc_target *tgt =3D abt_evt->tgt; struct ibmvfc_host *vhost =3D evt->vhost; + struct ibmvfc_tmf *tmf; =20 tmf =3D &evt->iu.tmf; memset(tmf, 0, sizeof(*tmf)); @@ -192,8 +183,18 @@ static void ibmvfc_init_ls_abort(struct ibmvfc_event *= evt, struct nvmefc_ls_req tmf->cancel_key =3D cpu_to_be32((u64)abt_evt); tmf->my_cancel_key =3D cpu_to_be32((u64)evt); tmf->assoc_id =3D cpu_to_be64(tgt->assoc_id); +} + +static void ibmvfc_nvme_ls_abort_done(struct ibmvfc_event *evt) +{ + u16 status =3D be16_to_cpu(evt->xfer_iu->mad_common.status); + + if (status) + ibmvfc_dbg(evt->vhost, "ls_abort: cancel MAD failed with rc=3D%x\n", + status); =20 - init_completion(&evt->comp); + kref_put(&evt->tgt->kref, ibmvfc_release_tgt); + ibmvfc_free_event(evt); } =20 static void ibmvfc_nvme_ls_abort(struct nvme_fc_local_port *lport, @@ -202,34 +203,35 @@ static void ibmvfc_nvme_ls_abort(struct nvme_fc_local= _port *lport, { struct ibmvfc_host *vhost =3D lport->private; struct ibmvfc_target *tgt =3D rport->private; - struct ibmvfc_event *evt; - union ibmvfc_iu rsp; + struct ibmvfc_event *evt, *abt_evt; unsigned long flags; - u16 status =3D IBMVFC_MAD_CRQ_ERROR; + + spin_lock_irqsave(&vhost->host->host_lock, flags); + + /* + * If the original LS has already completed naturally, abt_evt will + * have been freed back to the pool (evt->free set to 1 under + * host_lock by ibmvfc_free_event()). Nothing left to cancel. + */ + abt_evt =3D ls_abort->private; + if (!abt_evt || atomic_read(&abt_evt->free)) { + spin_unlock_irqrestore(&vhost->host->host_lock, flags); + return; + } =20 evt =3D ibmvfc_get_event(&vhost->crq); - if (!vhost->logged_in || !evt) + if (!vhost->logged_in || !evt) { + spin_unlock_irqrestore(&vhost->host->host_lock, flags); return; + } =20 - spin_lock_irqsave(&vhost->host->host_lock, flags); kref_get(&tgt->kref); - ibmvfc_init_event(evt, ibmvfc_sync_nvme_completion, IBMVFC_MAD_FORMAT); - ibmvfc_init_ls_abort(evt, ls_abort); - evt->sync_iu =3D &rsp; - - if (ibmvfc_send_event(evt, vhost, default_timeout)) - goto out; - - spin_unlock_irqrestore(&vhost->host->host_lock, flags); + ibmvfc_init_event(evt, ibmvfc_nvme_ls_abort_done, IBMVFC_MAD_FORMAT); + ibmvfc_init_ls_abort(evt, abt_evt); + evt->tgt =3D tgt; =20 - wait_for_completion(&evt->comp); - status =3D be16_to_cpu(rsp.mad_common.status); - spin_lock_irqsave(&vhost->host->host_lock, flags); - ibmvfc_free_event(evt); -out: + ibmvfc_send_event(evt, vhost, default_timeout); spin_unlock_irqrestore(&vhost->host->host_lock, flags); - ibmvfc_dbg(vhost, "ls_abort: cancel failed with rc=3D%x\n", status); - kref_put(&tgt->kref, ibmvfc_release_tgt); } =20 static void ibmvfc_nvme_done(struct ibmvfc_event *evt) --=20 2.55.0 From nobody Fri Sep 25 04:07:46 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B00E5514779; Wed, 16 Sep 2026 23:09:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789600193; cv=none; b=U33hivwtUKmu/cWnXXFy8PMIJ2M5hg4tF8brqW5WSqruY7xQiKc31kMlB8msQIz+xHkuri8h5CID4bA4NnoSBtuSZ+Z2hUTCjqjcd+0j3U6u4RL9nz97MNuZPsZUQIVSI9V6EORG0hdcs5ewubPFU+qo2d+mMHyYO8Kmr3BtN9g= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789600193; c=relaxed/simple; bh=tUJG8WstEMawhLEU5z20g38W8rtx9VTZK8laDi0uyxQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=RlJyXqeoK/9fjKqa334UC1QadI0r00hngp9uHcVWRKdJqjaNPxNoH8pRBXzE/EVE2QcmGC3UCWqULRxboKoncZEQK2TDKjw0kWz7/ZMoz3a6AiVHZ7MBrCOj9kgEm4CUdvsOrBnmtWnDJadkLxaQHMmH7EsZNvRj2t9I4OXqr+I= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=cGZAQmcT; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="cGZAQmcT" Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68GG1oqT2330705; Wed, 16 Sep 2026 23:09:46 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=pp1; bh=/rkG2+ RTcsFvr4mbe2ojqN4MphfaV5sN28KLxxZ4wlc=; b=cGZAQmcTfgrM5HoxdNt2Di uejxLwBGGmes5RHOhLMQt3Bspvaqx3bghUypLuJ0IZ0d+dEqulIKZ438GZfOmx9G 7Sru1NUenoU69SrEFQXr/oQcJNPEkhXZ/vErxn8qPNJyTO7KALWtvVhpA0P0lnIs g73kO4z+21jhfWzsq0hwYO6jpGZ+u2Swy8vATbW71hijcrhd43p430Eeyj41tjw3 z2TgS5enXS05+YISuPKIsFUZ1LA8SLz1eT/SQ4QEoTToDcNxpbfwOy2k7kqYjz3k ifCGWuyDFGqwyx3BpDu+434tDYgR1SxJh67S7IR50XhBhTHNo6tEX8P5qDvK1F/Q == Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gmxdqfda7-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Wed, 16 Sep 2026 23:09:46 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 68GMrtMN2599742; Wed, 16 Sep 2026 23:09:45 GMT Received: from smtprelay03.wdc07v.mail.ibm.com ([172.16.1.70]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4gpw6d9e9a-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 16 Sep 2026 23:09:45 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay03.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 68GN91H022872730 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 16 Sep 2026 23:09:01 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 0CAB55804E; Wed, 16 Sep 2026 23:09:44 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 1B1F658060; Wed, 16 Sep 2026 23:09:43 +0000 (GMT) Received: from li-4c4c4544-0054-3910-8039-c3c04f423534.ibm.com.com (unknown [9.61.141.190]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 16 Sep 2026 23:09:42 +0000 (GMT) From: Tyrel Datwyler To: james.bottomley@hansenpartnership.com, martin.petersen@oracle.com Cc: linux-scsi@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, brking@linux.ibm.com, davemarq@linux.ibm.com, Tyrel Datwyler Subject: [PATCH 15/20] scsi: ibmvfc: unregister NVMe local port on adapter removal Date: Wed, 16 Sep 2026 16:09:16 -0700 Message-ID: <20260916230921.2204729-16-tyreld@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260916230921.2204729-1-tyreld@linux.ibm.com> References: <20260916230921.2204729-1-tyreld@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTE2MDMyMiBTYWx0ZWRfXwW9pXpANmQA5 Sj++64eOXiaztnHyolCBtwpNKDSMASpH2zsZuhLGPDr82zVQdD571TJD4kovamOGjBDcGptyVGj SSgGJCJYlSoYq8K1dXsmrQ8lNKNsRXU7lz1jMvyIG6QDZojI0D6nYDg6KHtcSiJ+1tL8AjzRHmW 4OQ7mwWiHV6WnIGQbKDIML50JPpXKXckI0fRqDgAmuR5vt0qoCA22v0PtOEO/EshQ00/LgqjB+g G3Cl+LD9+QKRGt44VrSRtEkI8qeE9UeD7felT57JoimqtQ779NGvr2FgQa6lAEItIJ2KmxE79Cj qAa6WtpOFlq0QF01mmKcYh9ModmJHYPTkusOXl9zHqyzdkAl0N/9NoQ5bf0U6khPijVqI066V4t 0xh2V8UBDVzSRAlnhARhZKgFxKJV15XSK7t1Tj2aFp29qty47zZczpo0cQoSf+pIddQuaLIj19j PDW+DMQGsFU+FD+MkTQ== X-Proofpoint-GUID: LszIPjmvfXcB7eQhFi6jmif6JIC0g1Ai X-Authority-Analysis: v=2.4 cv=DobDa2/+ c=1 sm=1 tr=0 ts=6aab21ba cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=IkcTkHD0fZMA:10 a=VdqzKS8jKosA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=VnNF1IyMAAAA:8 a=FP1yMjY_cEXO16Dv5WoA:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 X-Proofpoint-ORIG-GUID: LszIPjmvfXcB7eQhFi6jmif6JIC0g1Ai X-Proofpoint-Spam-Info: AW1haW4tMjYwOTE2MDMyMiBTYWx0ZWRfX7gOK1x4wWQk3 N9bevllTcC0b09UXTbqhQeN61OjX2dECBWdec0UqQ5VtqK2sFcp2uwwFG17xbFvfQ/joGOsdzhY a3i+c+wO6Fx+ETl8LRVUhMTOZVGMs98= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-16_03,2026-09-16_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 malwarescore=0 priorityscore=1501 suspectscore=0 impostorscore=0 spamscore=0 clxscore=1015 adultscore=0 bulkscore=0 lowpriorityscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609160322 ibmvfc_remove() tears down the CRQ and frees all host memory but never calls ibmvfc_nvme_unregister(). The NVMe-FC transport therefore retains a live reference to the local port whose private pointer points into the now-freed ibmvfc_host, leading to a use-after-free whenever the transport subsequently touches the port (queue creation, port scanning, etc.). ibmvfc_nvme_unregister() is already called from the NPIV logout and host reset paths during normal operation; driver removal simply missed it. Add the call after ibmvfc_release_crq_queue() =E2=80=94 at which point the = CRQ is torn down so no further completions can arrive =E2=80=94 and before ibmvfc_free_mem(), so host memory is still valid while nvme_fc_unregister_localport() runs and waits for the localport_delete callback to complete. Fixes: 86e495358096 ("scsi: ibmvfc: implement LLDD callbacks for mapping nv= me-fc queues") Signed-off-by: Tyrel Datwyler --- drivers/scsi/ibmvscsi/ibmvfc-core.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/ibmvscsi/ibmvfc-core.c b/drivers/scsi/ibmvscsi/ib= mvfc-core.c index 190410847efb..7af1867b69c5 100644 --- a/drivers/scsi/ibmvscsi/ibmvfc-core.c +++ b/drivers/scsi/ibmvscsi/ibmvfc-core.c @@ -6995,6 +6995,8 @@ static void ibmvfc_remove(struct vio_dev *vdev) ibmvfc_release_sub_crqs(vhost); ibmvfc_release_crq_queue(vhost); =20 + ibmvfc_nvme_unregister(vhost); + ibmvfc_free_mem(vhost); spin_lock(&ibmvfc_driver_lock); list_del(&vhost->queue); --=20 2.55.0 From nobody Fri Sep 25 04:07:46 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E086C521228; Wed, 16 Sep 2026 23:09:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789600195; cv=none; b=H0jRNGdlzqN/ihVP5rS1Ugwv9epfPth3Ari1hHK7LYzNvl9wlam57SypMKI1+u6r0UAViUsmoMHc3NhxnYxY+pGm6YNN14PHO16yRRiSus+hfSWVrxPbkEFfamG/4sn1CX6j11x7PYnwSIecox3f+lo94Qe8UXV4zU47hukKyAM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789600195; c=relaxed/simple; bh=yzljTAN/xFVSW/xr1JEq/dyZNh+qNkWtPWqweFKR2WU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=CYSUjgo71kVUcGnHvwj22SxkMZdyhGsGTv4cs+1zIypG3KLSMJHxGNF7lFlE5DXuvC+R6VVK5eb/6s+bSHezGC4+rjYmmSIIYd0/nECFI8+0dATYJ8v+HmgTpoL4XxtUhea2pwCq4niJDmOBk6kY0fPZtkUI1+QKLYK8hNedxR4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=Dl0z1F2m; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="Dl0z1F2m" Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68GG1m87018184; Wed, 16 Sep 2026 23:09:47 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=cRBHCOWvtFPK+YojD /uI/RizSP1RwudTAkTqAH3Fv9A=; b=Dl0z1F2mj6XRITVPEylqh9ZkmIaPoZ4nW gM7XynmcEiw2IuUqq9c77fFaR92EQ0JdJ8zrCnizYzGxDzC+PK/cTKYYooseGaV5 rul+mcszfQorEHaOKLEnQXsrIm4hpcM0ovS2T4fD+xBlUt0nuTl1a48IVDPGXNXU X0Mk3Ehk9/wiFDH1y1wFXnwpGAAlx4dCR62TGXwjVWicLSj4fNzxHajguSaRc7mM Apo/W1LhgInCaqpo2ppZ674/jz0HQn5cZ7vnsQmaMf/6GzhJhO8Xt3omd9KQ1Jt6 R23hcO1VcL9nOf4Ns6PpbGKdpNNfANfRgAei8NwwWK/6CImRw9FRA== Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gmxf57dxe-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Wed, 16 Sep 2026 23:09:47 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 68GMrtMO2599742; Wed, 16 Sep 2026 23:09:46 GMT Received: from smtprelay04.wdc07v.mail.ibm.com ([172.16.1.71]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4gpw6d9e9e-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 16 Sep 2026 23:09:46 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay04.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 68GN9jHP64160104 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 16 Sep 2026 23:09:45 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 27E4958054; Wed, 16 Sep 2026 23:09:45 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 382B45804E; Wed, 16 Sep 2026 23:09:44 +0000 (GMT) Received: from li-4c4c4544-0054-3910-8039-c3c04f423534.ibm.com.com (unknown [9.61.141.190]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 16 Sep 2026 23:09:44 +0000 (GMT) From: Tyrel Datwyler To: james.bottomley@hansenpartnership.com, martin.petersen@oracle.com Cc: linux-scsi@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, brking@linux.ibm.com, davemarq@linux.ibm.com, Tyrel Datwyler Subject: [PATCH 16/20] scsi: ibmvfc: fix NVMe local port leak on fabric link bounce Date: Wed, 16 Sep 2026 16:09:17 -0700 Message-ID: <20260916230921.2204729-17-tyreld@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260916230921.2204729-1-tyreld@linux.ibm.com> References: <20260916230921.2204729-1-tyreld@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: Tuw5Gh1vDz90qGZ98JXTbsctV1CxhRTT X-Proofpoint-Spam-Info: AW1haW4tMjYwOTE2MDMyMiBTYWx0ZWRfX/OIQP1zi8+ge Qww3X2p7qrzIF261oAKtoyI5iyqza/YwUkmKHqxDjYpDZCzGrr9F8qm+keXOSrxxKYT8BMje35g ktl+9zeqZbdJy692WrPNUjnOe0jJvik= X-Authority-Analysis: v=2.4 cv=cvgOAF4i c=1 sm=1 tr=0 ts=6aab21bb cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=VdqzKS8jKosA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=U7nrCbtTmkRpXpFmAIza:22 a=VnNF1IyMAAAA:8 a=uX4RykLYdoWrl-1yWP0A:9 X-Proofpoint-ORIG-GUID: Tuw5Gh1vDz90qGZ98JXTbsctV1CxhRTT X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTE2MDMyMiBTYWx0ZWRfX73yP1fnpyaJF wKmL0VDI4bLcBb8EFHl/UacHGlwMoSTpjRsTAgiWRmXknLHEJKXaz0888AxHaVLRWZsmV9r+ZG2 lWuke0OkvUhHCMznLHDm1UF46uIMaHrALDmhMhDJ3nt/oKGHzpK5a+eQYdtl8T9xd6UJ5+ZFaMl tbf4IotaoXi60oa/5k+U12uOnDNv1au36Xn3pFSlhtJQtvSABArzHWQhLOwvPIPKGstKyiCqeC7 rwptYWq0zonP0Bv+2WM6U6bBWoawtyolv+51kIgEa3xst1RMapyVn2UtppsZ5fLLcvNNdJv5/OR QcZkm/NycQsJ9zsPP2SPBzEoFATCf8/dN7nfvntgJgIzKpd4OuIYw46E8BJRuoc8S52qjhgILqM 0HErLdgfwstKloDf9pAVRjuXbwidHqB0CHXJSb2+Vg7x86Iu0DoUDavDlAC8hxQwCib5NFw1G9s G4z/uPBzRX2sSShgJow== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-16_03,2026-09-16_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 lowpriorityscore=0 clxscore=1015 priorityscore=1501 suspectscore=0 bulkscore=0 impostorscore=0 phishscore=0 spamscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609160322 Content-Type: text/plain; charset="utf-8" When the fabric link goes down, ibmvfc_link_down() does not call ibmvfc_nvme_unregister(), so vhost->nvme_local_port remains set across the link bounce. When the adapter re-initializes and completes fabric login, ibmvfc_nvme_register() is called again unconditionally. nvme_fc_register_localport() finds the still-live port in the transport's list (FC_OBJSTATE_ONLINE) and returns -EEXIST, writing NULL into *portptr. The original local port is now orphaned in the transport with no way to reach it, while vhost->nvme_local_port is NULL, leaving NVMe functionality permanently broken for the lifetime of the adapter. Fix by unregistering any existing local port at the top of ibmvfc_nvme_register() before attempting to register a new one. ibmvfc_nvme_register() is called from ibmvfc_do_work() with host_lock dropped, so ibmvfc_nvme_unregister()'s wait_for_completion() is safe there. This makes ibmvfc_nvme_register() idempotent across link bounces without requiring changes to the link-down path. Fixes: 3831863f9f56 ("scsi: ibmvfc: register local nvme fc port after fabri= c login") Signed-off-by: Tyrel Datwyler --- drivers/scsi/ibmvscsi/ibmvfc-nvme.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/scsi/ibmvscsi/ibmvfc-nvme.c b/drivers/scsi/ibmvscsi/ib= mvfc-nvme.c index 7e18b79ae4cc..a757a3d4fe27 100644 --- a/drivers/scsi/ibmvscsi/ibmvfc-nvme.c +++ b/drivers/scsi/ibmvscsi/ibmvfc-nvme.c @@ -530,6 +530,10 @@ int ibmvfc_nvme_register(struct ibmvfc_host *vhost) if (!IS_ENABLED(CONFIG_NVME_FC)) return 0; =20 + /* Unregister any stale local port left from a previous link-up */ + if (vhost->nvme_local_port) + ibmvfc_nvme_unregister(vhost); + pinfo.node_name =3D fc_host_node_name(vhost->host); pinfo.port_name =3D fc_host_port_name(vhost->host); pinfo.port_id =3D fc_host_port_id(vhost->host); --=20 2.55.0 From nobody Fri Sep 25 04:07:46 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3B99852E053; Wed, 16 Sep 2026 23:09:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789600196; cv=none; b=JsFh0DdCQuI5R+1GjiDqnZSDnOLN9DHbAjsOMcKgNqqSqIjt8/yDj+Mj/R3q/QzwzL0eCDWVB8AfMgNQpWkW+v5/qNeeiB+tQffuReyR9J4HD5eNPkgz62EAFEnOz5ISUor2AlN/7wsPOodCWo6DrV3SsFwwe6UL3ZEQsg2MZ/E= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789600196; c=relaxed/simple; bh=q0VKrKypSngHPkeBURFX+ac0Y0ef4psgidY6f3ov5gw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=BL18KODfyKz5WqCfE4HsgRIlrkIfDWgk1IHAeIiaeDz8GbBKXANDLikKaBTp7eXDlHw9adwyAY87mzra4AJiSGY6tY2BekybnGKTyzpj0zEEI39zSVng/l2c9WK5v6ezdyB/AjDN53ljljPzWdIOoBDRT1H73KXMtqU29GRg2b8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=gYzO/jE6; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="gYzO/jE6" Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68GG1k4v3041641; Wed, 16 Sep 2026 23:09:48 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=Vj/mhw50k97v9Dqqi qcEkBZc5QnkHZWGkC6VJOmrH/U=; b=gYzO/jE6LmxTYsZgpzyz/f6OobU1P3x8F NCEVUmiZrdkpMsayXq2+7QvQ7uL8nN5J9qFn7mCqVEO4hVXutAaJG0a1LHptclSx I5bFB5OC1+KEPZyUWYHRQq1uMFq4poH4yfQ1FPiEcmnamA4TdcIvXJDNmfu6EGX+ q9DPJOmL6cig8IKjvE5yyCEimcRZ2AE0c9ZGMWUlKoXp9bfdO5Y14iR6VRlN0/bA w+Dq3KO/I21sAFULIfzW0lLXiuGOyijqlO7YJvB4zKr32++FQkn0GRqvMgKM574A kiFAVTvY3aJHvGVc8bAiFfMs3ZczeQVYNY6ap6Lyp9XTD6xJG1+ug== Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gmw5e73jx-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Wed, 16 Sep 2026 23:09:48 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 68GN12qE1713037; Wed, 16 Sep 2026 23:09:47 GMT Received: from smtprelay05.wdc07v.mail.ibm.com ([172.16.1.72]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4gpywf0w5b-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 16 Sep 2026 23:09:47 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay05.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 68GN9kRP17171162 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 16 Sep 2026 23:09:46 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 409405804E; Wed, 16 Sep 2026 23:09:46 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 5288458060; Wed, 16 Sep 2026 23:09:45 +0000 (GMT) Received: from li-4c4c4544-0054-3910-8039-c3c04f423534.ibm.com.com (unknown [9.61.141.190]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 16 Sep 2026 23:09:45 +0000 (GMT) From: Tyrel Datwyler To: james.bottomley@hansenpartnership.com, martin.petersen@oracle.com Cc: linux-scsi@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, brking@linux.ibm.com, davemarq@linux.ibm.com, Tyrel Datwyler Subject: [PATCH 17/20] scsi: ibmvfc: fix TOCTOU race in ibmvfc_nvme_create_queue() on adapter removal Date: Wed, 16 Sep 2026 16:09:18 -0700 Message-ID: <20260916230921.2204729-18-tyreld@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260916230921.2204729-1-tyreld@linux.ibm.com> References: <20260916230921.2204729-1-tyreld@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTE2MDMyMiBTYWx0ZWRfX3hFBk2sWSeGK 6CcBUhpGNRnfiehjvKNcJAr7EmGdUpIrTmM+uizG5tyixvSOCV0eX1wQdJPyCUasp9gxTt9Rb2u XWje7ToZk56vNQShBLNUdkiqFvOOXpooZjlKiK9BmbwrDofNDK3NC+VvnXXqOM8DNdx19RtHLgg vVacvf+bYvCred0RQ/+TFfUF6fW359A0cmuwZvNGOk0tePgJCY4wuhl6ckmtXThtlMP+WEcrPSx vVraimgRd9pTiDd89E1tKoQMVVeWvSG1wKWG3lr2i1VUUJizCIX29XmDTevM3aAj6VZk3MWAWBk ELWD9fup+QxgDLKg5tb30M7o/+PoTnDUEb5uby7+M976NSZvLer+kXuZg3Zzb9BbAdFN2zv/8rI MUKyumFYvU6ZwvQwiWODXKG5tjB18uh9zN8yw276ay9dBI6JUWUfK+UPEX9/HOckWev/Ue7IO5t eNRgm8Wpkwp0OHkPRwQ== X-Authority-Analysis: v=2.4 cv=E/NYNqdl c=1 sm=1 tr=0 ts=6aab21bc cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=VdqzKS8jKosA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=VnNF1IyMAAAA:8 a=M1I_nbD3KY5Z_so_vh8A:9 X-Proofpoint-ORIG-GUID: OeaXTyYp18V3aEvk-4z3Q1c3hLJLohuE X-Proofpoint-Spam-Info: AW1haW4tMjYwOTE2MDMyMiBTYWx0ZWRfX6J0s20Buri4a Fdw8Kd7iLLXi1qR9s1aS0Mqg9agGVWN2FvAZXskfRpOuMuAVk9Ue4zO1eE8oaGHGxBvstJW8G0M voTKFgeRduZ9iS5SEj9CGEwzTzznckU= X-Proofpoint-GUID: OeaXTyYp18V3aEvk-4z3Q1c3hLJLohuE X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-16_03,2026-09-16_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 lowpriorityscore=0 priorityscore=1501 spamscore=0 adultscore=0 clxscore=1015 bulkscore=0 malwarescore=0 suspectscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609160322 Content-Type: text/plain; charset="utf-8" ibmvfc_remove() called ibmvfc_release_sub_crqs() before ibmvfc_nvme_unregister(). ibmvfc_release_sub_crqs() frees the nvme_scrqs.scrqs array and sets active_queues to 0, but the nvme-fc transport is still live at that point and can call back into ibmvfc_nvme_create_queue(). That callback reads active_queues and dereferences scrqs without any lock, so the window between the guard check and the actual use can race with the teardown, leading to: - divide-by-zero in '(qidx - 1) % vhost->nvme_scrqs.active_queues' when active_queues has been zeroed concurrently, and - NULL pointer dereference on 'vhost->nvme_scrqs.scrqs[qhandle->index]' when scrqs has been freed and set to NULL concurrently. ibmvfc_nvme_unregister() already calls nvme_fc_unregister_localport() followed by wait_for_completion(), which blocks until the transport has fully quiesced all queue operations. It just needs to happen before the sub-CRQ memory is released. Move ibmvfc_nvme_unregister() before ibmvfc_release_sub_crqs() in ibmvfc_remove() so the transport is quiesced before the sub-CRQ arrays are freed. The reset path (ibmvfc_reset_crq) is unaffected: it only deregisters sub-CRQs at the hypervisor level and never frees them, so active_queues and scrqs remain valid across a reset. Fixes: 186f72e38029 ("scsi: ibmvfc: implement LLDD callbacks for mapping nv= me-fc queues") Signed-off-by: Tyrel Datwyler --- drivers/scsi/ibmvscsi/ibmvfc-core.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/scsi/ibmvscsi/ibmvfc-core.c b/drivers/scsi/ibmvscsi/ib= mvfc-core.c index 7af1867b69c5..93189692191e 100644 --- a/drivers/scsi/ibmvscsi/ibmvfc-core.c +++ b/drivers/scsi/ibmvscsi/ibmvfc-core.c @@ -6992,11 +6992,10 @@ static void ibmvfc_remove(struct vio_dev *vdev) list_splice_init(&vhost->purge, &purge); spin_unlock_irqrestore(&vhost->host->host_lock, flags); ibmvfc_complete_purge(&purge); + ibmvfc_nvme_unregister(vhost); ibmvfc_release_sub_crqs(vhost); ibmvfc_release_crq_queue(vhost); =20 - ibmvfc_nvme_unregister(vhost); - ibmvfc_free_mem(vhost); spin_lock(&ibmvfc_driver_lock); list_del(&vhost->queue); --=20 2.55.0 From nobody Fri Sep 25 04:07:46 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1FBB7530DEA; Wed, 16 Sep 2026 23:09:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789600197; cv=none; b=QzGEJFPTB1pMEfS12UeMMSDpZdsl3DRYs0VCAYF1pmYfJFHYfUDaZe+pjazvhZApPLoU7+g4SMXIlbuLWMISty+7Dsk/IgF5H4b9zc7T9snbkna5XDooUfAaGY3/r/NjQMuZG+QLOeXfQnod96JcBuqZIpXhNUsp+gfHOelMZ5w= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789600197; c=relaxed/simple; bh=rgVT3wN05mtR0wVmodPRJgzZeltxN2x8DeHhU3FVo7Q=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=YzZ7A4KdD9sGBE2w+LDBRUXGfO7avdALC0h+qjEnalPzvGzmo3TcpIgtNzPepIfhs/ZBBNnsi872RHE6yDOdtpTga+/bc9H9hG/M3RY1RVngSXSnHb6fHnr80Su2cIZsx+CSBKTFVnJGj4ePNPKvjiMvfQPu+2Fa2zqHahYdUq4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=Ia3PeJ0k; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="Ia3PeJ0k" Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68GG1bMS4057200; Wed, 16 Sep 2026 23:09:49 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=pp1; bh=CUWkOg NJs+S2I9guIEGrq4RU0vb6psXCglD3/VkXnr4=; b=Ia3PeJ0k3dnqRnXLmHi+wc hwFT9LxrOnmEvUw/bnaCsIZSQYz8vLeU5n9wEXIgc82JSGhpA8BCz2H9mDI5Qcy4 YT+zcqlBgjm0GLiSjihHzvUE3K37Fk6MiUfczq/rHaWQ4cLFFS0ibcYMSW5ajnke DEaHcbta1DCGnXQWe9Hqfm+S3vnt6KFSsmeqkVRSTY9D82sFwT3XOjAR5/xeY5Pe pReoBUFG70mnOMTwBz5hrP1Adxy5963tVy8YvpGb0U0qice9DjK1/6w1WqBXpqWJ xwMSIKd+rwryB/TTnYXxQwhmdRYP9m6NuEU2SU3cjH2iRAyH3HNjk2D3/OkIEy/A == Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gmv5hy9vj-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Wed, 16 Sep 2026 23:09:49 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 68GN2IAV1699595; Wed, 16 Sep 2026 23:09:48 GMT Received: from smtprelay06.wdc07v.mail.ibm.com ([172.16.1.73]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 4gq03vgug6-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 16 Sep 2026 23:09:48 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay06.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 68GN9lDJ24117778 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 16 Sep 2026 23:09:47 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 57B2C58054; Wed, 16 Sep 2026 23:09:47 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 6CAAA5804E; Wed, 16 Sep 2026 23:09:46 +0000 (GMT) Received: from li-4c4c4544-0054-3910-8039-c3c04f423534.ibm.com.com (unknown [9.61.141.190]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 16 Sep 2026 23:09:46 +0000 (GMT) From: Tyrel Datwyler To: james.bottomley@hansenpartnership.com, martin.petersen@oracle.com Cc: linux-scsi@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, brking@linux.ibm.com, davemarq@linux.ibm.com, Tyrel Datwyler Subject: [PATCH 18/20] scsi: ibmvfc: fix NVMe sub-queue registration failure disabling SCSI multiqueue Date: Wed, 16 Sep 2026 16:09:19 -0700 Message-ID: <20260916230921.2204729-19-tyreld@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260916230921.2204729-1-tyreld@linux.ibm.com> References: <20260916230921.2204729-1-tyreld@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTE2MDMyMiBTYWx0ZWRfX2mRyg3CP3mu9 Llbq6bokMo0MQmI4+jqWZNlYmegVdsBRGZMKhfhO6qnEMhVTGs3F7U91EKF9VDzMOQKImhYCGWw oksmMYlmauCYi+1cxpmPz6Yyvcln7mAlnAKc1ewUl5R7ZSXmtnFqexQhaka49W5sWpqWtuybdxj smz9RlrRaUVfMD21e2AWc+sS9pkikTGwXfjc/GoPLqMHqON2r/HEck+dKCkZcg3X6pjN+UDiiWy 2n81p5habBT6uk3sykxYCK4Zi1MMxGajUZdQVVif2qo45jYaRwKOyr+QQo+3dbqEygVryS5+Dhb OHvNdDO5nEEjI2ehOYITUl4mdrEgq8kKnqPK675F7/sEPusNeP3n/nMk65NFl1BNiOQjFxZBzJr nyo8uudjRcASqHSlRPXpy/0IxAbtLx6A3hdxmUHcUekT+a8+3GODMJ+LUjsdxn1SKu/z/++TdKo ZoPHPex55OeKTmxwraA== X-Proofpoint-Spam-Info: AW1haW4tMjYwOTE2MDMyMiBTYWx0ZWRfXxY5Vdo/emS4H 8uYs9phZnO+X+CXfA6S6JxqR51DZJFwJPzrQDZFJ90OyvsCH06AmJ8fREXxz09EO0/mztKXjc8v TmbBUUskxEAuQm9eL2RJEcGU/JZ45eM= X-Authority-Analysis: v=2.4 cv=Zsx4uN7G c=1 sm=1 tr=0 ts=6aab21bd cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=IkcTkHD0fZMA:10 a=VdqzKS8jKosA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=Y2IxJ9c9Rs8Kov3niI8_:22 a=VnNF1IyMAAAA:8 a=To5To57u1w-uQxo1Mx4A:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 X-Proofpoint-ORIG-GUID: oqtPaZAwKHanj0Mqrz0476d9XTXaaxtk X-Proofpoint-GUID: oqtPaZAwKHanj0Mqrz0476d9XTXaaxtk X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-16_03,2026-09-16_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 impostorscore=0 clxscore=1015 priorityscore=1501 lowpriorityscore=0 bulkscore=0 adultscore=0 phishscore=0 spamscore=0 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609160322 ibmvfc_reg_sub_crqs() clears vhost->do_enquiry unconditionally when any channel registration fails. The function is called for SCSI channels first and then for NVMe channels (in ibmvfc_init_sub_crqs(), ibmvfc_reset_crq(), and ibmvfc_reenable_crq_queue()). If the NVMe channel registration fails, do_enquiry is cleared even though SCSI channels registered successfully, preventing the IBMVFC_CHANNEL_ENQUIRY MAD from being sent and silently disabling multiqueue support for SCSI. ibmvfc_init_sub_crqs() already handles NVMe *allocation* failure correctly =E2=80=94 it only clears nvme_enabled without touching do_enquiry. The same logic needs to apply when NVMe *registration* fails. Fix ibmvfc_reg_sub_crqs() to check channels->protocol in the failure path: clear do_enquiry only for a SCSI channel failure (preserving existing behaviour), and clear nvme_enabled instead for an NVMe channel failure. This covers all three call sites in one place. Fixes: bf86ac3ca0d2 ("scsi: ibmvfc: alloc/dealloc sub-queues for nvme chann= els") Signed-off-by: Tyrel Datwyler --- drivers/scsi/ibmvscsi/ibmvfc-core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/ibmvscsi/ibmvfc-core.c b/drivers/scsi/ibmvscsi/ib= mvfc-core.c index 93189692191e..d79a6ae278a2 100644 --- a/drivers/scsi/ibmvscsi/ibmvfc-core.c +++ b/drivers/scsi/ibmvscsi/ibmvfc-core.c @@ -6527,7 +6527,10 @@ static void ibmvfc_reg_sub_crqs(struct ibmvfc_host *= vhost, if (ibmvfc_register_channel(vhost, channels, i)) { for (j =3D i; j > 0; j--) ibmvfc_deregister_channel(vhost, channels, j - 1); - vhost->do_enquiry =3D 0; + if (channels->protocol =3D=3D IBMVFC_PROTO_SCSI) + vhost->do_enquiry =3D 0; + else + vhost->nvme_enabled =3D 0; return; } } --=20 2.55.0 From nobody Fri Sep 25 04:07:46 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BC7B4525A75; Wed, 16 Sep 2026 23:09:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789600195; cv=none; b=lUXl0+M1/gePj2Lja7J2EqgXTYCjWohF+WEPLofB6CkQHWfyKfVMkq5PEwARc3S7W5ZOEjUXJARH7St4P3ZnAUPm1k1xv/0089Hq8U7N+5QsMdTVKKmLFqaU54Je4gH1H1eKHYUmkRgklBWbv+FqCbhiUCkLZRi4cvkYPL9/5wM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789600195; c=relaxed/simple; bh=lMnCOqW9twuqplBoKPo1DuqP9I+1zxHFDl4oiA13QZE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Aqtq6vTVSLPq7PVRQ18nwQtbfe9zb6d1Jd3xlpOh88+S/ymSymMQPaYMDx5vjiupKrf3IIPJcjzoCFTXVUDQjeBBDn1eV0kIDqDF18tUlrPO4wDOqAui4TEdt/yFI+UYVTaV7CFkFqIZUvemb69T5UpbQdZZVBu4QhOK/RdJBjo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=H6h8ayxm; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="H6h8ayxm" Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68GG1her018055; Wed, 16 Sep 2026 23:09:50 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=9D5mYXYJ/iFbWNghP D2J7ml+M5BIYyM8rFvM7PPc8no=; b=H6h8ayxmb21o3Z4dxgX8VAkQFUA8uko1g wezQXR5LBZyJj7a2oL2rTblTqT1gdBpF/giP4bHFzbkBwR/sTFHvWSjnxJF/h9ZZ TpBDdFGQAGjxZsd+IeuQXYzknxKYDuXtvCRPTj4N/Mn9u46KgkXWXpO0C0EafycR S8IEsciVURIqiJUj8qCaYDwQgRkck2djgHmwjm7y3dFy+DmhFus7Nqk1B0nDbnsG KMVZOIW3UbDuGBjkWUmVtdfPNCa52Ry/jF6QhOwhVQuiPkLW/QkDn9/XedIJSK4s nBeeOcCmvTFGlB0go5nvEkokGyfR0xWBe6vXUiL+KvwFKlc4kIXqw== Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gmxf57dxk-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Wed, 16 Sep 2026 23:09:50 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 68GN0FJC1625390; Wed, 16 Sep 2026 23:09:49 GMT Received: from smtprelay07.wdc07v.mail.ibm.com ([172.16.1.74]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4gpyxsgw7e-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 16 Sep 2026 23:09:49 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay07.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 68GN9mDv16515834 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 16 Sep 2026 23:09:48 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 7651E58056; Wed, 16 Sep 2026 23:09:48 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 867F758054; Wed, 16 Sep 2026 23:09:47 +0000 (GMT) Received: from li-4c4c4544-0054-3910-8039-c3c04f423534.ibm.com.com (unknown [9.61.141.190]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 16 Sep 2026 23:09:47 +0000 (GMT) From: Tyrel Datwyler To: james.bottomley@hansenpartnership.com, martin.petersen@oracle.com Cc: linux-scsi@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, brking@linux.ibm.com, davemarq@linux.ibm.com, Tyrel Datwyler Subject: [PATCH 19/20] scsi: ibmvfc: fix concurrent SCSI and NVMe discover-targets race dropping targets Date: Wed, 16 Sep 2026 16:09:20 -0700 Message-ID: <20260916230921.2204729-20-tyreld@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260916230921.2204729-1-tyreld@linux.ibm.com> References: <20260916230921.2204729-1-tyreld@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: IHabPtbunrr8X0z-sbLDx-geB87DiOYi X-Proofpoint-Spam-Info: AW1haW4tMjYwOTE2MDMyMiBTYWx0ZWRfX2zKbsob9TTW+ 14SxSlj0AtS0mJi0Oebmus5UYerpUCAfZp2YeNd1lDySu6PYpM6e2Evj6vBKxfFLINirslRIpSF cnTopY8ZSTwhgpXjMxnT5z1tT9SUg5U= X-Authority-Analysis: v=2.4 cv=cvgOAF4i c=1 sm=1 tr=0 ts=6aab21be cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=VdqzKS8jKosA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=U7nrCbtTmkRpXpFmAIza:22 a=VnNF1IyMAAAA:8 a=yQvEpV7r-B_hb1frPhEA:9 X-Proofpoint-ORIG-GUID: IHabPtbunrr8X0z-sbLDx-geB87DiOYi X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTE2MDMyMiBTYWx0ZWRfX3SbIltLGwaql WEfpL88G3HqOlJ9nIVVsxTgyp+5RMP2kqulcrAGhN2bbnJb2MvZM4B88xmBPzWxj4evRAdPs+fT Nf7nPtFLooGQVTXbYJfJg0ZscpsD+d1PfVQ0qNtoISVJhlAx1OqQ6GNqdOh6CzP74nnAN2RAS5G 95mlsLG8nFSLvGx+J/aJORzpPnmL6lRTB68fvdbqopv5hbb4pLJRPa73r5ZCA6ZVt+33LliUVoC BWEk7MsSGsjELH5BDgYIRiPrMsFoxD4z/aGqcJYBA4ab9YfA/NA3DfJmkTbyVflgBOxo5nvoN4i gMmpVz17tA5l9OAzb7O7HWCZ3xrpGjyMPeHU+X4x9fHkuCMRCbpf40n5aAYEcJp8LYbSeopqLOE xgFD6Thlcczreiu5oDHA03MSMxRwCEAOY+UZR80lzh6MC7zX32zyt3kwYEKD59L1celrBiXN2ne bO4qh+PJztWOFoPgAIg== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-16_03,2026-09-16_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 lowpriorityscore=0 clxscore=1015 priorityscore=1501 suspectscore=0 bulkscore=0 impostorscore=0 phishscore=0 spamscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609160322 Content-Type: text/plain; charset="utf-8" ibmvfc_discover_targets() sends both SCSI and NVMe discover-targets MADs concurrently. ibmvfc_discover_targets_done() unconditionally set IBMVFC_HOST_ACTION_ALLOC_TGTS and woke the work thread on the first completion to arrive. ibmvfc_alloc_targets() then ran immediately, reading both channels' disc_buf and num_targets fields. If the second MAD had not yet completed, the slower protocol's num_targets was still zero from the previous discovery cycle, and all targets for that protocol were silently dropped. The second completion then attempted to transition to ALLOC_TGTS again, but the state machine had already advanced, so the transition was a no-op and ibmvfc_alloc_targets() was never re-run. Fix this by adding a pending_disc:2 counter to ibmvfc_host. ibmvfc_discover_targets() sets it to 1 before sending the SCSI MAD and increments it to 2 before sending the NVMe MAD (skipped when NVMe is not active, leaving the counter at 1). ibmvfc_discover_targets_done() decrements the counter on success and only calls ibmvfc_set_host_action(ALLOC_TGTS) when it reaches zero, ensuring both discovery buffers are fully written before target allocation starts. Error paths already call ibmvfc_retry_host_init() or ibmvfc_link_down() which reset the state machine, so they do not need to interact with the counter. Fixes: bffd16f59061 ("scsi: ibmvfc: add logic for protocol specific fabric = logins") Signed-off-by: Tyrel Datwyler --- drivers/scsi/ibmvscsi/ibmvfc-core.c | 6 +++++- drivers/scsi/ibmvscsi/ibmvfc.h | 1 + 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/ibmvscsi/ibmvfc-core.c b/drivers/scsi/ibmvscsi/ib= mvfc-core.c index d79a6ae278a2..b0d9000b4a0d 100644 --- a/drivers/scsi/ibmvscsi/ibmvfc-core.c +++ b/drivers/scsi/ibmvscsi/ibmvfc-core.c @@ -5156,7 +5156,8 @@ static void ibmvfc_discover_targets_done(struct ibmvf= c_event *evt) max_targets); ibmvfc_dbg(vhost, "%d %s targets found\n", channels->num_targets, proto_type[channels->protocol]); - ibmvfc_set_host_action(vhost, IBMVFC_HOST_ACTION_ALLOC_TGTS); + if (!--vhost->pending_disc) + ibmvfc_set_host_action(vhost, IBMVFC_HOST_ACTION_ALLOC_TGTS); break; case IBMVFC_MAD_FAILED: level +=3D ibmvfc_retry_host_init(vhost); @@ -5220,6 +5221,7 @@ static void ibmvfc_discover_targets(struct ibmvfc_hos= t *vhost) } =20 ibmvfc_set_host_action(vhost, IBMVFC_HOST_ACTION_INIT_WAIT); + vhost->pending_disc =3D 1; =20 if (!ibmvfc_send_event(evt, vhost, default_timeout)) ibmvfc_dbg(vhost, "Sent discover SCSI targets\n"); @@ -5236,6 +5238,8 @@ static void ibmvfc_discover_targets(struct ibmvfc_hos= t *vhost) return; } =20 + vhost->pending_disc++; + if (!ibmvfc_send_event(evt, vhost, default_timeout)) ibmvfc_dbg(vhost, "Sent discover NVMe targets\n"); else diff --git a/drivers/scsi/ibmvscsi/ibmvfc.h b/drivers/scsi/ibmvscsi/ibmvfc.h index df0775183d72..a984b81f1d23 100644 --- a/drivers/scsi/ibmvscsi/ibmvfc.h +++ b/drivers/scsi/ibmvscsi/ibmvfc.h @@ -1006,6 +1006,7 @@ struct ibmvfc_host { unsigned int do_scsi_login:1; unsigned int do_nvme_login:1; unsigned int do_nvme_register:1; + unsigned int pending_disc:2; unsigned int aborting_passthru:1; unsigned int scan_complete:1; int scan_timeout; --=20 2.55.0 From nobody Fri Sep 25 04:07:46 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B66784D7D29; Wed, 16 Sep 2026 23:09:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789600196; cv=none; b=DqmJi8ZSsKkSaY8niuUsqCRBz43sP/3Uwhh/0+MUgYvGFo/G7eODCAo0VGJ7ogssYmhdoDM9jStpkboBdiw3ith40qJ8JKZR8UTkow3igep9xBztqix2RPCZka1mqNHb0uA/JsGF9yj4N28kUC6uWZpQrqzIgBJHYOpiy07DQkI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789600196; c=relaxed/simple; bh=WyLkftnjHpqj0vlwloLnKLZGsHdDfilGAD2mhpzqcDU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=nYW2BlAL6hmIiUnSyzrD6rlyaSrauZHTYh9LqGhopmvrKdMxKckiAjFkAQeG9B+cCAEZqYN0+nIHTt6gEhYg6THEwrtWTRdPPWWjAeg+jjmMIPjioOiQolJI4o5lt/CLUhS9cW4tCNvuaxV3nGNhfB+uMkVWbWtZCagqwAx6swM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=gEoL/lC/; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="gEoL/lC/" Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68GG1UEK006689; Wed, 16 Sep 2026 23:09:52 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=9cxc677mE3uJ9eTKT bzk7cg4m0MicNMjE0fu7maRZvQ=; b=gEoL/lC/hCXVwSZ+XPy4rwSJNrU3OvASm ANzRcikv/pwpnIvRbqzbEzBRxD2LCkq5NP6Y7FxWDmb3OfsTC/PfOxWPKzuPoGjJ uQ5ndyiozsNSOZ7k0GoboSZXuvJefjD2qJDOFz0MVF/MBsNOCqcRUS0H18RnKa5V jMxKGlYd928fzLij+wlS0wUUZdw4WYRfEv53IAgsmRWMbNrzbZwkFi/Meq+s01YB CtrgVDGzMoV1/GjDhXPLaqDg7fFcdXhrKczNjSpV4II5DobTW8wvfOq9k/LxDGvu T5p4+dfyS6tKLwYqtJWvoeTb/KBr/DNuaMxgC57G7ZYSOpPKtUdtg== Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gmx83ye06-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Wed, 16 Sep 2026 23:09:52 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 68GMxnNc1649291; Wed, 16 Sep 2026 23:09:51 GMT Received: from smtprelay02.dal12v.mail.ibm.com ([172.16.1.4]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4gq03c0upc-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 16 Sep 2026 23:09:51 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay02.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 68GN9nUh25887388 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 16 Sep 2026 23:09:49 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 8F4D458054; Wed, 16 Sep 2026 23:09:49 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id A3C575804E; Wed, 16 Sep 2026 23:09:48 +0000 (GMT) Received: from li-4c4c4544-0054-3910-8039-c3c04f423534.ibm.com.com (unknown [9.61.141.190]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 16 Sep 2026 23:09:48 +0000 (GMT) From: Tyrel Datwyler To: james.bottomley@hansenpartnership.com, martin.petersen@oracle.com Cc: linux-scsi@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, brking@linux.ibm.com, davemarq@linux.ibm.com, Tyrel Datwyler Subject: [PATCH 20/20] scsi: ibmvfc: fix nr_nvme_hw_queues module parameter ignored for NVMe queue sizing Date: Wed, 16 Sep 2026 16:09:21 -0700 Message-ID: <20260916230921.2204729-21-tyreld@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260916230921.2204729-1-tyreld@linux.ibm.com> References: <20260916230921.2204729-1-tyreld@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTE2MDMyMiBTYWx0ZWRfX41zQYcEuAqPv SczMpImiZdSa0vg51sJQN32cDdzTLJvzgi4fr5DRXA2Qymc1+Fxtmt0IHgpE+opQmRPZeAi2xL6 zRp0NrVW/6gfXD32YtOBZ06FFlVcYZMYgt6GwyGt8lrpYPFBTyWaPq+jQZbNpqQ/YEpivIVJbkb 3mqQsciDp0qQFfouRUWsVKvYP9iVbmUYMlYDSPUe0WQKM0zTntnYRkzsVw8Q0T/chPIreaZeqo3 ayEJdK6Je+YJC5GrVyf779t6x1FVRPTPkJOIawVs5bybYPropOLKOn6qBeMPxqYI6nvv6a18Xfm G0vkztWF5e3qBcjEBiEkof9DemPeZLd4uh0gUCZUA9IrKHALtv/NbYfUpKO5WcQovY1bEsVwWcd fyY0cNmtsfd2z7/JKqcbyGh67ai4z2CS4JckWKJi0taR7HWfRattc/CA4zZ0cQPzcPNKed6bYyQ FGzQI7tZ5huk9osx0Pw== X-Proofpoint-ORIG-GUID: 83b0NWhM6F5nG_qVs5--cVVw4DuNyPGT X-Proofpoint-GUID: 83b0NWhM6F5nG_qVs5--cVVw4DuNyPGT X-Proofpoint-Spam-Info: AW1haW4tMjYwOTE2MDMyMiBTYWx0ZWRfX1rTnDP6+ZqFX 8xw5OkbFFAVM5tGjyYKFzTr4ziTaU4cTpuXPJ8MEsTEHeOe+Uxupe0voGf7g53cLyB8Mkt+5FcY LY6/CXdrh0oI71C3IRKzje/1T+asdbc= X-Authority-Analysis: v=2.4 cv=cY9HPXDM c=1 sm=1 tr=0 ts=6aab21c0 cx=c_pps a=5BHTudwdYE3Te8bg5FgnPg==:117 a=5BHTudwdYE3Te8bg5FgnPg==:17 a=VdqzKS8jKosA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=iQ6ETzBq9ecOQQE5vZCe:22 a=VnNF1IyMAAAA:8 a=YHccNbNTKC1xL-9NveAA:9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-16_03,2026-09-16_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 spamscore=0 bulkscore=0 clxscore=1015 suspectscore=0 impostorscore=0 malwarescore=0 phishscore=0 adultscore=0 lowpriorityscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609160322 Content-Type: text/plain; charset="utf-8" max_nvme_queues was computed as min(IBMVFC_MAX_NVME_QUEUES, online_cpus), silently ignoring the nr_nvme_hw_queues module parameter. The SCSI path correctly caps shost->nr_hw_queues with nr_scsi_hw_queues, but the NVMe equivalent was never applied, making the 'nvme_host_queues' parameter a no-op. Apply the same pattern as the SCSI side: incorporate nr_nvme_hw_queues into the max_nvme_queues calculation at probe time so that nvme_scrqs.max_queues and nvme_scrqs.desired_queues both respect the administrator-provided limit. Fixes: 99d71f6b2c78 ("scsi: ibmvfc: initialize NVMe channel configuration d= uring driver probe") Signed-off-by: Tyrel Datwyler --- drivers/scsi/ibmvscsi/ibmvfc-core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/ibmvscsi/ibmvfc-core.c b/drivers/scsi/ibmvscsi/ib= mvfc-core.c index b0d9000b4a0d..df7976918f8f 100644 --- a/drivers/scsi/ibmvscsi/ibmvfc-core.c +++ b/drivers/scsi/ibmvscsi/ibmvfc-core.c @@ -6866,7 +6866,9 @@ static int ibmvfc_probe(struct vio_dev *vdev, const s= truct vio_device_id *id) int rc =3D -ENOMEM; unsigned int online_cpus =3D num_online_cpus(); unsigned int max_scsi_queues =3D min_t(unsigned int, IBMVFC_MAX_SCSI_QUEU= ES, online_cpus); - unsigned int max_nvme_queues =3D min_t(unsigned int, IBMVFC_MAX_NVME_QUEU= ES, online_cpus); + unsigned int max_nvme_queues =3D min_t(unsigned int, + min(IBMVFC_MAX_NVME_QUEUES, nr_nvme_hw_queues), + online_cpus); =20 ENTER; shost =3D scsi_host_alloc(&driver_template, sizeof(*vhost)); --=20 2.55.0