From nobody Fri Sep 25 04:07:26 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 571BA2931D3; Sat, 19 Sep 2026 01:33:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789781602; cv=none; b=X3VTnzDXUYtJ/MZU1atiHMlXfwow5WyOxpcKayobdJt2+140+grU4h8pzoj/5ht0js9EeiyCX/SL3//fZkhUwMpp/oaW11/hWdqoJWy5HmA5JvEl8SbxWd3BqAl+vwUfXHjaqPb+R//vEQuZ0W9XlrkvJHte5BIW1R/XE7L2huw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789781602; c=relaxed/simple; bh=zgxjKpn1kyNMIBVwaF12Kde+LXaxrhu50R6RDuOyIJY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=JBQKndvZMNxuT1jZTFFukDeGUc0ECWe+L99DvJgTNSgoy2bwaJF8TqKAtPBJcDo6+pzRTMTdJEaiacMOdijCeK5B+Y7ExX+1/JMIWKsjY3i4rOsMSeZ3aNw3U78hj0R33kxaxqUUBHyMFGWykMTe7wgi6sfxGWY8wP60YgW+wDA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=UsVT/QAS; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="UsVT/QAS" Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68J01m9m2706907; Sat, 19 Sep 2026 01:33:13 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=ClrGPMR2eCl1PGakK 33NKTydd8/M9xCYys0xvOiUDi8=; b=UsVT/QASmz5vWWbXgEmBbkC37V07kFZeh Ua38cAQ3mhFlrrmAPmQcQZ3dhAY0WeItxV8F2fymdmPfeFc3IyKmyMvOwmoft/6n bfl+yiLDx1/mAkVVaaYCXwWvRFhWgSuON8Ho4WnNn6B5ajrneF5HgJ4bQAAgoCqx VDKDUJBLNkMk3afWwkDy7JCqO7RpFGKxpaFgeNQ5ZHnF4tXJ0Mt0wPKSipyYxdVm aUwxSy5jbZhel+eajASV9Y7x660hxrO/W7GERq1nQu12AR0CIDE9mYf1XY8kywHa 5c+OQiocOrvqCqZznl4dJW70d97zc1mB/Dw6Wv0jKdrUDW4h0rFfw== Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gmxcvj9mb-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Sat, 19 Sep 2026 01:33:13 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 68J1UJDq2574299; Sat, 19 Sep 2026 01:33:12 GMT Received: from smtprelay05.dal12v.mail.ibm.com ([172.16.1.7]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4gsgssg066-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 19 Sep 2026 01:33:12 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (smtpav02.dal12v.mail.ibm.com [10.241.53.101]) by smtprelay05.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 68J1XBo117891892 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 19 Sep 2026 01:33:11 GMT Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id B109358051; Sat, 19 Sep 2026 01:33:11 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 135935805A; Sat, 19 Sep 2026 01:33:11 +0000 (GMT) Received: from li-4c4c4544-0054-3910-8039-c3c04f423534.ibm.com.com (unknown [9.61.101.145]) by smtpav02.dal12v.mail.ibm.com (Postfix) with ESMTP; Sat, 19 Sep 2026 01:33:10 +0000 (GMT) From: Tyrel Datwyler To: james.bottomley@hansenpartnership.com, martin.petersen@oracle.com Cc: linux-scsi@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, brking@linux.ibm.com, davemarq@linux.ibm.com, Tyrel Datwyler Subject: [PATCH v2 01/20] scsi: ibmvfc: initialize evt->tgt for NVMe FCP commands Date: Fri, 18 Sep 2026 18:32:47 -0700 Message-ID: <20260919013306.2948028-2-tyreld@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260919013306.2948028-1-tyreld@linux.ibm.com> References: <20260919013306.2948028-1-tyreld@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Info: AW1haW4tMjYwOTE5MDAxOCBTYWx0ZWRfX8KuuHX5p7DbH pyQe3WxsZ8bXKvsPLTAZc6a31X+CQGwK4OeOQN2YLmmy6mvJ6wIeHZnNPWz2n6pzPnTw0vdclR0 mhfeX/MdheZoUsY55Ad/3/ri340BrSw= X-Proofpoint-ORIG-GUID: Rb0heMknMFAYqjXtnDCzp8iOtvtRZFzy X-Proofpoint-GUID: Rb0heMknMFAYqjXtnDCzp8iOtvtRZFzy X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTE5MDAxOCBTYWx0ZWRfXz7azyFtaSsd3 XdbVURY6puhdBKY+C9VChVrv8CdTkR44A0+6VRkvR6mPj/DP1u60/iwpfJCS/CURVBVv5eDQH4A kdHQDwdJIuykrYxQyVzFrAFj1ZHH/6FFQcujIqmlpBhHAq6XZZXmWFYqum2eLocMybi7pc2FxA/ vYUySvrpm+HZ8jO0gGvrf15VwsicKZKIOydREIvHFkEHae7I7o5/WMxcKaWxmm6yLTYEr2IYhcD lRxkbI9vPjyOtxZXj5avPAzFXmam5TbhJczcNumvcg4bVVuOuYf/l7y7b5msWV8REDP3t+zk4KJ 2HZwAFiqm7Ro02yc8APYdOpa6k+ilVcmYhqTOLq/6abhsGp7U2l8uh/GRwrKMkbiZ7QKwiCYxRc YtRi910g2CZv/TiV0VJmDeULjDYhK46JHFzI/B5lZIX8CuR0SxHxrsGfCoz/ayGJoNJP+vvKfq4 jZasvkBNufpGWOWL5Fw== X-Authority-Analysis: v=2.4 cv=F+7C5ahN c=1 sm=1 tr=0 ts=6aade659 cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=VdqzKS8jKosA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=RzCfie-kr_QcCd8fBx8p:22 a=VnNF1IyMAAAA:8 a=24aaq1eNYdOIN5PvXmkA:9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-18_07,2026-09-16_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 suspectscore=0 phishscore=0 clxscore=1015 malwarescore=0 lowpriorityscore=0 bulkscore=0 spamscore=0 impostorscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609190018 Content-Type: text/plain; charset="utf-8" ibmvfc_nvme_fcp_io() submits NVMe FCP requests without setting evt->tgt on the allocated event. ibmvfc_init_event() does not initialize this field, so it retains whatever value was left in the pool-allocated event structure. When an FCP request times out the NVMe-FC transport calls ibmvfc_nvme_fcp_abort(), which in turn calls ibmvfc_init_fcp_abort() to build the cancel MAD. That function derives the target pointer from abt_evt->tgt: struct ibmvfc_target *tgt =3D abt_evt->tgt; ... tmf->target_wwpn =3D cpu_to_be64(tgt->wwpn); tmf->assoc_id =3D cpu_to_be64(tgt->assoc_id); Because abt_evt->tgt was never initialized this is a guaranteed NULL or stale-pointer dereference on the first NVMe I/O timeout, resulting in a kernel panic. Fix this by assigning evt->tgt =3D rport->private immediately after ibmvfc_init_event(), consistent with how ibmvfc_nvme_ls_req() already sets evt->tgt for LS requests. This also has the benefit of making the associated remote port target visible on in-flight FCP events, which is useful for live debugging (e.g. reading tgt->wwpn from a hung command in a crash/kdump context). Fixes: 4e70b8795ee3 ("scsi: ibmvfc: implement nvme-fc FCP abort callback") Signed-off-by: Tyrel Datwyler --- drivers/scsi/ibmvscsi/ibmvfc-nvme.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/scsi/ibmvscsi/ibmvfc-nvme.c b/drivers/scsi/ibmvscsi/ib= mvfc-nvme.c index 9ac2671a3567..9ed6522c2e9e 100644 --- a/drivers/scsi/ibmvscsi/ibmvfc-nvme.c +++ b/drivers/scsi/ibmvscsi/ibmvfc-nvme.c @@ -359,6 +359,7 @@ static int ibmvfc_nvme_fcp_io(struct nvme_fc_local_port= *lport, ibmvfc_dbg(vhost, "vfc-nvme-mq-%d\n", evt->hwq); =20 ibmvfc_init_event(evt, ibmvfc_nvme_done, IBMVFC_CMD_FORMAT); + evt->tgt =3D rport->private; evt->fcp_req =3D fcp_req; fcp_req->private =3D evt; =20 --=20 2.55.0 From nobody Fri Sep 25 04:07:26 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DDFAB3403ED; Sat, 19 Sep 2026 01:33:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789781602; cv=none; b=n1jfhWI0mPwGOGDGMSIqypV7NSFnka4urNEKGAxdjlYsH8A6TmJG42nAc2m5IDwzvXbx/g7byqQk6f2pcXBcXMuNpD6sSA3AucH0E8Y+oq1o9cFT2UvqhNQZKAjA8N1Q+CF0ZIUl1aVkF7qPOhU64khROKovq6nJOA2Fd/cYUgw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789781602; c=relaxed/simple; bh=+2AcnY/qLDXKehHQ28QjSs8q+UviDM872kt8hGuGl8U=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=CZ3IASm5SK4UQuM2d2RWoSgfPdPa6IyJOYCB+qz0k47MW1iwneih/eCMWMNTHz86mOG1daaEx2RJMsvjZSkDuU+vG6FSs6GAPgghDLoTrBRErYADMySw5s+I194QEyORA4mu1KQUJkShXQE0/pxHsdZRzUbGgPzu7GoA69Zkygc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=lBxz+WOP; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="lBxz+WOP" Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68J1WARA1677125; Sat, 19 Sep 2026 01:33:14 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=AAvMCQkdZO91wfgvq VOlY3PB7FOIxuESr6sA/j/Mey4=; b=lBxz+WOPAndV07JLeRfY/ErHoOVbyavWV jWMDjDxfZp3bHq/9yqn7D1rUyabEvSO4oC0ySBFsyW5GdYWRUYg6nNU4C7c7wq39 Z4b/k/rEpnsbpb1CetG1j6UUUsz0fnh2t7bFQ9ToO0yndi6eFeQhk8kggf05pTpA BgEAeK8nublTFoB/PjzfnqfwW6M78Gm3VZVBnTyW0uZli58ZP8izYKOH2WEIHrlC fMsQlxW9fyLs4kNi3SOtlZqbMovC5ow1aSa2xW2OGaRJVexG5BGJKlf+bUaBQm9P hDeK138FADDA5sTNKKb/cQytCiUykUfFpGfJWvcoz67UIePvNPjkQ== Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gsgtd803j-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Sat, 19 Sep 2026 01:33:13 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 68J1RaOW1658899; Sat, 19 Sep 2026 01:33:13 GMT Received: from smtprelay06.dal12v.mail.ibm.com ([172.16.1.8]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 4gsgrgg0cj-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 19 Sep 2026 01:33:13 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (smtpav02.dal12v.mail.ibm.com [10.241.53.101]) by smtprelay06.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 68J1XCmo33817268 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 19 Sep 2026 01:33:12 GMT Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 70FF558051; Sat, 19 Sep 2026 01:33:12 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id CDF3E5805A; Sat, 19 Sep 2026 01:33:11 +0000 (GMT) Received: from li-4c4c4544-0054-3910-8039-c3c04f423534.ibm.com.com (unknown [9.61.101.145]) by smtpav02.dal12v.mail.ibm.com (Postfix) with ESMTP; Sat, 19 Sep 2026 01:33:11 +0000 (GMT) From: Tyrel Datwyler To: james.bottomley@hansenpartnership.com, martin.petersen@oracle.com Cc: linux-scsi@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, brking@linux.ibm.com, davemarq@linux.ibm.com, Tyrel Datwyler Subject: [PATCH v2 02/20] scsi: ibmvfc: fix trace logging for NVMe FCP commands Date: Fri, 18 Sep 2026 18:32:48 -0700 Message-ID: <20260919013306.2948028-3-tyreld@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260919013306.2948028-1-tyreld@linux.ibm.com> References: <20260919013306.2948028-1-tyreld@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTE5MDAxOCBTYWx0ZWRfX8pCJZxqc5wiY XmaOCisx1Pv7tw2WtJk+ZZdJd8ygt2tkZk3V71WTpo4WvCtQM71+lrWRNzbOqBvB6jmm8aZJNeQ 6xE6T1vcDb9PKnKG/rxUenu3gfrxRUZT2tq6HVkymzSRv00gWheo48gkghWk7B6RL2B5GmHDsYN gpfoeN1BOABmASoKLBSbZv+1MaomVGzcR6a5WP4JVOLDmQVHxMC03u2dL6Jk5dhCdQuWjEfZL7/ e3H9vDAUQS8hFTfjHvKAGFvv9ArhhEfzt2ORT8ShcFcJfaQfS5UX46cui2hMu2ZJzoAnKOFqj9y vug8srmgT23+0FHPAWBKivLnZcbk0mShaWmjsQFYdXYfAiwb36fo+1QUNi5xDwDI6Wvrg5CQ4bi KqpSEpdTsKh4S+ok3WNugVY+KTf4IzmHQM2dXXmVJkHhmJ+Mm/WHTltODBKmy8QzBlqqw6Ar7yF d2WIuzNduxJrQ6qZpJw== X-Proofpoint-GUID: woipL11UiEIZ-8niWEEeDiWyIJ9VpHct X-Proofpoint-ORIG-GUID: woipL11UiEIZ-8niWEEeDiWyIJ9VpHct X-Authority-Analysis: v=2.4 cv=Q49HcI2a c=1 sm=1 tr=0 ts=6aade65a cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=VdqzKS8jKosA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=VnNF1IyMAAAA:8 a=fF8LTD-R--w6NU_6X2kA:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwOTE5MDAxOCBTYWx0ZWRfXwV9+9MbwmJpU LL+tOamlcs2/XoNCr7uyGcGUgrB64MILUp5TDrEEmoKbiubriw7I9oP7miqa7ugmY4xn9Q8sKqd qX04j+qGDvGcGT33pAwV6i2buc9LeoM= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-18_07,2026-09-16_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 bulkscore=0 suspectscore=0 spamscore=0 impostorscore=0 phishscore=0 malwarescore=0 clxscore=1015 adultscore=0 lowpriorityscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609190018 Content-Type: text/plain; charset="utf-8" ibmvfc_trc_start() and ibmvfc_trc_end() handle IBMVFC_CMD_FORMAT events by reading SCSI-specific fields via ibmvfc_get_fcp_iu() and ibmvfc_get_fcp_rsp(). These helpers return a pointer into the v3scsi union member of struct ibmvfc_cmd, but NVMe FCP commands store their command IU in the v3nvme union member. Reading SCSI FCP fields out of an NVMe IU produces garbage trace entries (wrong opcode, lun, tmf_flags, xfer_len, rsp_code, and scsi_status). Fix this by gating the SCSI-specific field reads on evt->cmnd within the IBMVFC_CMD_FORMAT branch. For NVMe FCP events (evt->fcp_req set) record the NVMe SQE opcode from v3nvme.iu.sqe.common.opcode and the payload length from vfc_cmd->payload_len. The common fields that are valid for both protocols (tgt_scsi_id, vfc_cmd->status, vfc_cmd->error) are logged unconditionally. Fixes: 73c13e30c56f ("scsi: ibmvfc: implement nvme-fc IO command submission= callback") Signed-off-by: Tyrel Datwyler --- drivers/scsi/ibmvscsi/ibmvfc-core.c | 31 +++++++++++++++++++---------- 1 file changed, 21 insertions(+), 10 deletions(-) diff --git a/drivers/scsi/ibmvscsi/ibmvfc-core.c b/drivers/scsi/ibmvscsi/ib= mvfc-core.c index aa7ae81df41b..6558ed3c67c4 100644 --- a/drivers/scsi/ibmvscsi/ibmvfc-core.c +++ b/drivers/scsi/ibmvscsi/ibmvfc-core.c @@ -250,6 +250,7 @@ static void ibmvfc_trc_start(struct ibmvfc_event *evt) int index =3D atomic_inc_return(&vhost->trace_index) & IBMVFC_TRACE_INDEX= _MASK; =20 entry =3D &vhost->trace[index]; + memset(entry, 0, sizeof(*entry)); entry->evt =3D evt; entry->time =3D jiffies; entry->fmt =3D evt->crq.format; @@ -257,11 +258,16 @@ static void ibmvfc_trc_start(struct ibmvfc_event *evt) =20 switch (entry->fmt) { case IBMVFC_CMD_FORMAT: - entry->op_code =3D iu->cdb[0]; entry->scsi_id =3D be64_to_cpu(vfc_cmd->tgt_scsi_id); - entry->lun =3D scsilun_to_int(&iu->lun); - entry->tmf_flags =3D iu->tmf_flags; - entry->u.start.xfer_len =3D be32_to_cpu(iu->xfer_len); + if (evt->cmnd) { + entry->op_code =3D iu->cdb[0]; + entry->lun =3D scsilun_to_int(&iu->lun); + entry->tmf_flags =3D iu->tmf_flags; + entry->u.start.xfer_len =3D be32_to_cpu(iu->xfer_len); + } else if (evt->fcp_req) { + entry->op_code =3D vfc_cmd->v3nvme.iu.sqe.common.opcode; + entry->u.start.xfer_len =3D evt->fcp_req->payload_length; + } break; case IBMVFC_MAD_FORMAT: entry->op_code =3D be32_to_cpu(mad->opcode); @@ -287,6 +293,7 @@ static void ibmvfc_trc_end(struct ibmvfc_event *evt) int index =3D atomic_inc_return(&vhost->trace_index) & IBMVFC_TRACE_INDEX= _MASK; =20 entry =3D &vhost->trace[index]; + memset(entry, 0, sizeof(*entry)); entry->evt =3D evt; entry->time =3D jiffies; entry->fmt =3D evt->crq.format; @@ -294,15 +301,19 @@ static void ibmvfc_trc_end(struct ibmvfc_event *evt) =20 switch (entry->fmt) { case IBMVFC_CMD_FORMAT: - entry->op_code =3D iu->cdb[0]; entry->scsi_id =3D be64_to_cpu(vfc_cmd->tgt_scsi_id); - entry->lun =3D scsilun_to_int(&iu->lun); - entry->tmf_flags =3D iu->tmf_flags; entry->u.end.status =3D be16_to_cpu(vfc_cmd->status); entry->u.end.error =3D be16_to_cpu(vfc_cmd->error); - entry->u.end.fcp_rsp_flags =3D rsp->flags; - entry->u.end.rsp_code =3D rsp->data.info.rsp_code; - entry->u.end.scsi_status =3D rsp->scsi_status; + if (evt->cmnd) { + entry->op_code =3D iu->cdb[0]; + entry->lun =3D scsilun_to_int(&iu->lun); + entry->tmf_flags =3D iu->tmf_flags; + entry->u.end.fcp_rsp_flags =3D rsp->flags; + entry->u.end.rsp_code =3D rsp->data.info.rsp_code; + entry->u.end.scsi_status =3D rsp->scsi_status; + } else if (evt->fcp_req) { + entry->op_code =3D vfc_cmd->v3nvme.iu.sqe.common.opcode; + } break; case IBMVFC_MAD_FORMAT: entry->op_code =3D be32_to_cpu(mad->opcode); --=20 2.55.0 From nobody Fri Sep 25 04:07:26 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B76D036C9C2; Sat, 19 Sep 2026 01:33:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789781604; cv=none; b=WPEUm4bbmwsfI4nEG4ljiO8Z0FAPekwXBQAsE0nwbJIQ4YdwHYSL4Js2g9JMf+AYtth6ucYz8HmZXQU5qdwghPP1vhvxGfLmtuqBBnBY8Pmxh7jwWcHhQNYMg/CU/LXoRfzDIdjCw5yT3ox77W8CK9oaUYC0MqAmiTQmN9DX1+M= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789781604; c=relaxed/simple; bh=vhedG9c7hmGOJg6z8NUH9DdYNV94yuO4+sUpYL2ek38=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=PEmV6FswdRb0DtYubZsWAL93N81NArdp+xaxOdMnzElnKSyAdrH+kTQvSHorC/9J++IRBbkWkT87iz4c8c8McW9BWLbGwMkOloib4+rBJkPqVQX2W6QtsmdxfjOTQ+++LdO1f3sRykoWjjliPvOfwmpJY7UxePXh84phn4S+N8g= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=n6zzwntB; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="n6zzwntB" Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68J01eaj2680782; Sat, 19 Sep 2026 01:33:15 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=8QENcYT+uY2y/J7ad uxzfKAjqXBVUFJpBRX5/9wMenY=; b=n6zzwntBiD6pXj6GUU2+VqSEsxJhod2BQ KeiDrNY/L3qN8trwt8TmaQABBK9+8dDXlO0qwmNF21CMReBD1nn9UtVvoTpr20wC La1G8WDT+0iwovNxIXB24By0luRA96Vdm8lGDbW9G5ABdJ/Vjn2oj/JwmQAr9ZHF 25HoxLAiqbWRYO8hc41350rTtcSerN57quALNa/RDGPMGwAKCGc+ArJCZmaun1AF 5r2vGqYmICBZGxLhXkhGeiBk298634TJn78231vvSnIbH2refjt0JK5G+eeyeQjh XUNsPF2umlVuQ8D/mqRr7TSMoiqXOgePEtssYoiyCf4ZFJsGvCVCg== Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gmxf5k1tt-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Sat, 19 Sep 2026 01:33:14 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 68J1UJoP2574292; Sat, 19 Sep 2026 01:33:14 GMT Received: from smtprelay07.dal12v.mail.ibm.com ([172.16.1.9]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4gsgssg069-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 19 Sep 2026 01:33:14 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (smtpav02.dal12v.mail.ibm.com [10.241.53.101]) by smtprelay07.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 68J1XDc415139554 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 19 Sep 2026 01:33:13 GMT Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 2E1FD58051; Sat, 19 Sep 2026 01:33:13 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 8DB7B5805A; Sat, 19 Sep 2026 01:33:12 +0000 (GMT) Received: from li-4c4c4544-0054-3910-8039-c3c04f423534.ibm.com.com (unknown [9.61.101.145]) by smtpav02.dal12v.mail.ibm.com (Postfix) with ESMTP; Sat, 19 Sep 2026 01:33:12 +0000 (GMT) From: Tyrel Datwyler To: james.bottomley@hansenpartnership.com, martin.petersen@oracle.com Cc: linux-scsi@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, brking@linux.ibm.com, davemarq@linux.ibm.com, Tyrel Datwyler Subject: [PATCH v2 03/20] scsi: ibmvfc: complete NVMe FCP requests on H_CLOSED send failure Date: Fri, 18 Sep 2026 18:32:49 -0700 Message-ID: <20260919013306.2948028-4-tyreld@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260919013306.2948028-1-tyreld@linux.ibm.com> References: <20260919013306.2948028-1-tyreld@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: yprec2gKLBpzQl3BGWbMC07fqHoIGzVF X-Proofpoint-Spam-Info: AW1haW4tMjYwOTE5MDAxOCBTYWx0ZWRfX+Ex4CL9w4Sxn 5yeWMRFuaPyA51pFoWmCchGSB2wltWDlmGRz7swg0ikl0DsrEuR8NowSAfkVTFPLsHUCVD72ndX /k90Xc9zAvgbR8y4QhwWXMfOdku8xt0= X-Authority-Analysis: v=2.4 cv=cvgOAF4i c=1 sm=1 tr=0 ts=6aade65a cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=VdqzKS8jKosA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=U7nrCbtTmkRpXpFmAIza:22 a=VnNF1IyMAAAA:8 a=FURy-cA78QglurSbi6AA:9 X-Proofpoint-ORIG-GUID: yprec2gKLBpzQl3BGWbMC07fqHoIGzVF X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTE5MDAxOCBTYWx0ZWRfX69AvVsZNMzxc zqIq4wpa8keVzxUjGCMlM39U8Epl4Pgjn4cxHR46LQ7Vrv/MDks31028MgYqlI1HrNcs20m4Sb1 o0x0qVRH75lyVT4R8Bx2fAVMXeI5OVQ4FiY+oz4zO6eZRs9XW5sqAuOIZGwDEXcmjwbQRj5gl9f vibyqmAXxIuoMa14yFewA/cP3/iNYHUSQ1xz/ExWWfOC+YyddMie2stQLqUPE9CQR2LRkajs1d6 xqkNsmBKQsZ6PhopaJGG7R05335qyFlYu/D31t+ccrFZfP1RaUh60gHR/kdTHsyi7iuEhoQaew2 5kmbUgoAt79GsegLLXdHuB4lEW1qihsqpoSwhvbxjIngoOMEQQ5ikuLXz3qI9nio6U1VTfxqtc/ luQV/Az1WJWylxQS4kINbAX/V6OkfH3ruN2aNFa+a5TwRyWQufCTKqK9CsU2z3bo/DzAvYXnXvC yJYFTa6bjb6RgUrfBYw== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-18_07,2026-09-16_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 lowpriorityscore=0 clxscore=1015 priorityscore=1501 suspectscore=0 bulkscore=0 impostorscore=0 phishscore=0 spamscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609190018 Content-Type: text/plain; charset="utf-8" When ibmvfc_send_event() returns H_CLOSED the event is freed without notifying the NVMe-FC transport. The caller ibmvfc_nvme_fcp_io() returns SCSI_MLQUEUE_HOST_BUSY back to the transport, which is a SCSI midlayer concept the NVMe-FC transport does not interpret. The result is that the NVMe-FC transport is left waiting on a request that was silently dropped, causing the I/O to hang permanently. Fix this by calling fcp_req->done() with a -EBUSY status before freeing the event in the H_CLOSED path, consistent with how other FC-NVMe LLDDs (e.g. lpfc) signal a retryable transport-level failure to the NVMe-FC transport. Fixes: 73c13e30c56f ("scsi: ibmvfc: implement nvme-fc IO command submission= callback") Signed-off-by: Tyrel Datwyler --- drivers/scsi/ibmvscsi/ibmvfc-nvme.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/ibmvscsi/ibmvfc-nvme.c b/drivers/scsi/ibmvscsi/ib= mvfc-nvme.c index 9ed6522c2e9e..08dd897b8e64 100644 --- a/drivers/scsi/ibmvscsi/ibmvfc-nvme.c +++ b/drivers/scsi/ibmvscsi/ibmvfc-nvme.c @@ -367,8 +367,12 @@ static int ibmvfc_nvme_fcp_io(struct nvme_fc_local_por= t *lport, =20 vfc_cmd->correlation =3D cpu_to_be64((u64)evt); =20 - if (likely(!(rc =3D ibmvfc_nvme_map_sg_data(fcp_req, evt, vfc_cmd)))) - return ibmvfc_send_event(evt, vhost, 0); + if (likely(!(rc =3D ibmvfc_nvme_map_sg_data(fcp_req, evt, vfc_cmd)))) { + rc =3D ibmvfc_send_event(evt, vhost, 0); + if (rc) + return -EBUSY; + return 0; + } =20 ibmvfc_free_event(evt); =20 --=20 2.55.0 From nobody Fri Sep 25 04:07:26 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F1C1A392803; Sat, 19 Sep 2026 01:33:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789781605; cv=none; b=JyVkIytZX/vvbY7nZ7f1YUrDRFRWOkXsn0mdoP4uJpAEnOPMM17UMJo+JucKvvld6xyy8Zk/tcnSteOSquBAFkLMWWkR3MPUP27v/bXoJZuXDt+OWEDksx/Qj1lvzbJMB/NhZdn2fXmUGOy7AYxCgoM9AvVonbudPJ+U2BMAGko= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789781605; c=relaxed/simple; bh=SboujiZPx0dO95s8SWb4cg5yhHk8NZ+4vwp4FI/oTx4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=uHkrnHub6afvP3nvoAX8HTXEdLiDYi6XpT1MrJniHb1PtByO8pBC5Cwgmt6lqXZ5+UGx0ry3nA77KhIBtGU79W0Bqesubltxt+FVQqDJFsnA0hDycUAV4UdpjSzejQ6M0SozqEoEwrE+DoUcqvsFoSdCM1X5GgfpV7DxOOwuNbY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=M3PMstWt; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="M3PMstWt" Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68J01YgF2662346; Sat, 19 Sep 2026 01:33:15 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=pp1; bh=qKWjd2 VxrQCWdkJT+HzuuJcqIBWYZesLYnGWk9djE3k=; b=M3PMstWt3fqgQePf4cmhrB 5xcC6rZMEt5wZY3VcVmGnQXwC6FGHEy4TIvh9klWQDtHhoRjDEwuqTcBlDcsY7b3 RmhTnA8vWlhDDs7xv5FwPkc/fv9PPnRPkCT7NL6DyNcON9xNg6nFLiVPRQMJiD7K HAMaKU4mWQszW6tez1gTdFQpTlXlOf4xIL/wVrJnrYC8NBP8B2gjCIwzxbo/cwLl NjQeO7fEGXbw1kQXoDWRYOItmQBynhBGxaL4VVTR2Oa7OZmZ+xqq2rTyJFm9NQGX gpuBwW++aBWLZxVfHtNQ67KC0yb2py83GENs2vy85rFDR8e8fvU1lBwpKQfTuILQ == Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gmx84b0j9-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Sat, 19 Sep 2026 01:33:15 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 68J1RaOX1658899; Sat, 19 Sep 2026 01:33:14 GMT Received: from smtprelay07.dal12v.mail.ibm.com ([172.16.1.9]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 4gsgrgg0cm-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 19 Sep 2026 01:33:14 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (smtpav02.dal12v.mail.ibm.com [10.241.53.101]) by smtprelay07.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 68J1XDnF15139558 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 19 Sep 2026 01:33:14 GMT Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id E277858051; Sat, 19 Sep 2026 01:33:13 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 4A38F5805A; Sat, 19 Sep 2026 01:33:13 +0000 (GMT) Received: from li-4c4c4544-0054-3910-8039-c3c04f423534.ibm.com.com (unknown [9.61.101.145]) by smtpav02.dal12v.mail.ibm.com (Postfix) with ESMTP; Sat, 19 Sep 2026 01:33:13 +0000 (GMT) From: Tyrel Datwyler To: james.bottomley@hansenpartnership.com, martin.petersen@oracle.com Cc: linux-scsi@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, brking@linux.ibm.com, davemarq@linux.ibm.com, Tyrel Datwyler Subject: [PATCH v2 04/20] scsi: ibmvfc: defer NVMe local port registration out of atomic context Date: Fri, 18 Sep 2026 18:32:50 -0700 Message-ID: <20260919013306.2948028-5-tyreld@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260919013306.2948028-1-tyreld@linux.ibm.com> References: <20260919013306.2948028-1-tyreld@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTE5MDAxOCBTYWx0ZWRfX4ay4QnTBCntQ vX6+EvRZ0TSAYgUJ0rANvogJBSAEIPH9Ofh8Cqh6456WB+jHX2UampYahOYfG/URxFrjqEknAPC /NLwQ/uKSVQ70lQbqJ/iqyyRs6RQOoeYuRDgK9Ch7qT3D7IIGdZMk4+5KfRCVdRaU+LLTtjNfdv YULE/wWaYnqJNpNIOgNreAZz6fZLW9QmO6RGvt+0wfAu7tI7jo6q/xy5nie5zNOs7VOTP4+c4bf cGcsg6dyuG7pR8g2VlAA/4E3Cs4WpTsUjnuvmG0Ct05KvHsW7CVl6PKiY0jdpQC9J+6Jy7vK9Y3 GnPgJpO5vOEXYk1/iA3/ouRReQXd18ZqzhZcnfuNxlsOdvIGgY1w7Rx0b6z1kAI7DlXY1+ATJnW 06VroyVgxJmpGOIxfDQk1M5ndmXzNI/b0kTites/9qtuHvLYRoLu8NVL4wt2F2bryjplOVTzHZj 6J0GoeT7ew4g3j+Vqbg== X-Proofpoint-ORIG-GUID: IDmpCSFxxlZa1ZxrAbCzZds_d48jCqCT X-Proofpoint-GUID: IDmpCSFxxlZa1ZxrAbCzZds_d48jCqCT X-Proofpoint-Spam-Info: AW1haW4tMjYwOTE5MDAxOCBTYWx0ZWRfXzLdzzxJgWoya gOKLmJvL7tWF57bqQ5WVlgfCKjpAE9DRkKTMtejPsiRg+OA84UFTOL2uCetItMxn4RMJXpchRAA M5040MLdtZyNB7dfiTwKr9YGE7sqEmY= X-Authority-Analysis: v=2.4 cv=cY9HPXDM c=1 sm=1 tr=0 ts=6aade65b cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=IkcTkHD0fZMA:10 a=VdqzKS8jKosA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=iQ6ETzBq9ecOQQE5vZCe:22 a=VnNF1IyMAAAA:8 a=kpGpFJlvQmPtm4ZHpHAA:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-18_07,2026-09-16_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 spamscore=0 bulkscore=0 clxscore=1015 suspectscore=0 impostorscore=0 malwarescore=0 phishscore=0 adultscore=0 lowpriorityscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609190018 ibmvfc_fabric_login_nvme_done() is invoked under vhost->host->host_lock via the ibmvfc_locked_done() wrapper, which acquires the spinlock with IRQs disabled before calling the MAD completion handler. On the IBMVFC_MAD_SUCCESS path the handler called ibmvfc_nvme_register() directly. That function calls nvme_fc_register_localport(), which performs GFP_KERNEL memory allocations and may sleep =E2=80=94 both illegal inside a spinlock-held (atomic) context =E2=80=94 resulting in a 'scheduling while atomic' kernel panic during NVMe/FC fabric login. Fix this by replacing the direct call with a new do_nvme_register flag that mirrors the existing do_nvme_login pattern already used in the driver. The flag is consumed in ibmvfc_do_work() under the IBMVFC_HOST_ACTION_QUERY case, which runs in the kernel thread context (ibmvfc_work) where sleeping allocations are safe. The lock is dropped before calling ibmvfc_nvme_register() and re-acquired on return so the rest of the QUERY case proceeds normally. Fixes: 3831863f9f56 ("ibmvfc: register local nvme fc port after fabric logi= n") Signed-off-by: Tyrel Datwyler --- drivers/scsi/ibmvscsi/ibmvfc-core.c | 12 +++++++++++- drivers/scsi/ibmvscsi/ibmvfc.h | 1 + 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/ibmvscsi/ibmvfc-core.c b/drivers/scsi/ibmvscsi/ib= mvfc-core.c index 6558ed3c67c4..728529155ded 100644 --- a/drivers/scsi/ibmvscsi/ibmvfc-core.c +++ b/drivers/scsi/ibmvscsi/ibmvfc-core.c @@ -991,6 +991,7 @@ static int ibmvfc_reenable_crq_queue(struct ibmvfc_host= *vhost) vhost->using_channels =3D 0; vhost->do_scsi_login =3D 0; vhost->do_nvme_login =3D 0; + vhost->do_nvme_register =3D 0; spin_unlock(vhost->crq.q_lock); spin_unlock_irqrestore(&vhost->host->host_lock, flags); =20 @@ -1032,6 +1033,7 @@ static int ibmvfc_reset_crq(struct ibmvfc_host *vhost) vhost->using_channels =3D 0; vhost->do_scsi_login =3D 0; vhost->do_nvme_login =3D 0; + vhost->do_nvme_register =3D 0; =20 /* Clean out the queue */ memset(crq->msgs.crq, 0, PAGE_SIZE); @@ -5243,7 +5245,7 @@ static void ibmvfc_fabric_login_nvme_done(struct ibmv= fc_event *evt) switch (mad_status) { case IBMVFC_MAD_SUCCESS: fc_host_port_id(vhost->host) =3D be64_to_cpu(rsp->nport_id); - ibmvfc_nvme_register(vhost); + vhost->do_nvme_register =3D 1; ibmvfc_dbg(vhost, "NVMe fabric login succeeded\n"); break; case IBMVFC_MAD_FAILED: @@ -6070,6 +6072,14 @@ static void ibmvfc_do_work(struct ibmvfc_host *vhost) vhost->job_step(vhost); break; case IBMVFC_HOST_ACTION_QUERY: + if (vhost->do_nvme_register) { + vhost->do_nvme_register =3D 0; + spin_unlock_irqrestore(&vhost->host->host_lock, flags); + ibmvfc_nvme_register(vhost); + spin_lock_irqsave(&vhost->host->host_lock, flags); + if (vhost->action !=3D IBMVFC_HOST_ACTION_QUERY) + break; + } list_for_each_entry(tgt, &vhost->scsi_scrqs.targets, queue) ibmvfc_init_tgt(tgt, ibmvfc_tgt_query_target); list_for_each_entry(tgt, &vhost->nvme_scrqs.targets, queue) diff --git a/drivers/scsi/ibmvscsi/ibmvfc.h b/drivers/scsi/ibmvscsi/ibmvfc.h index ca80ceffe53a..df0775183d72 100644 --- a/drivers/scsi/ibmvscsi/ibmvfc.h +++ b/drivers/scsi/ibmvscsi/ibmvfc.h @@ -1005,6 +1005,7 @@ struct ibmvfc_host { unsigned int nvme_enabled:1; unsigned int do_scsi_login:1; unsigned int do_nvme_login:1; + unsigned int do_nvme_register:1; unsigned int aborting_passthru:1; unsigned int scan_complete:1; int scan_timeout; --=20 2.55.0 From nobody Fri Sep 25 04:07:26 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A81903BFE47; Sat, 19 Sep 2026 01:33:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789781607; cv=none; b=SgleBKjXML8MI6iMHrRENsjOfmEz9ZYqapSEfuO+QUGayVKODhzbm4JmX+wdn4vDuJxGM8lrxikvPZEnNAUVLgD2F/bfvGFRWHHHkNZhgi6oLu4Lezxoyx4gp513CAqLdhVI86GsnEntcviKJpfxc88xIPuzEDk8QYDrMvmceSs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789781607; c=relaxed/simple; bh=u5oamuhUXqB9jYcFVqckUFU1xMKZJ5jOAlwQQFm4LNk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=MwwOmJqUG6eBU9YgWhDISnfzPf0ewa+ysrQYuIgoYee4LD/fIEYBmVV4P0jlc9NjK9O1h6JMpsKP+3wQ8BKjrmrZNehx2YuQDT0fZ6IfgcfHo59veXnQNT0EzcgA+TyYW9xU9LXH7XzpjtQgCbtyLM+GnrHBFGoEyCBhigZN+zE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=PCXjwVCT; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="PCXjwVCT" Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68J1VoAn1676582; Sat, 19 Sep 2026 01:33:16 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=pp1; bh=7fTQf6 ReF8hydpMgBC35nO4+APuXySgFtlnCWFDzEOY=; b=PCXjwVCTSd1Mcn6uxfT//H nvizIyt8ecGY2zErOlpyqjDibqBrolggVygz4U6/bIIqbg/6/+jbUy7xE9KQ27mn lNLrp/E84kGIu4sQsu+l76Z+dP+FpfFNrQdesZSifRMUO/4N4oB/exJv5rYEIVrw b5+BukGkY3EzRhK6PZYwnbJ7GaZdCNssgOqran72f+sDsWRqRGcyfPHtwUhAQ1XZ kMAldU6VhEU4/4dqHCzn0nySqBYNNwdfS+boMRZ2F6bGNHYydhX24CtY/5xHG012 0i6Po4Pk2ODz0jy/75W39Trtmeh3KFEPFUjMdGpBuCKRH0REnZ8IOSnyw0+59SZg == Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gsgtd803m-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Sat, 19 Sep 2026 01:33:16 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 68J1UIuX2574042; Sat, 19 Sep 2026 01:33:15 GMT Received: from smtprelay02.dal12v.mail.ibm.com ([172.16.1.4]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4gsgssg06e-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 19 Sep 2026 01:33:15 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (smtpav02.dal12v.mail.ibm.com [10.241.53.101]) by smtprelay02.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 68J1XEAE24576536 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 19 Sep 2026 01:33:14 GMT Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id A6B7758051; Sat, 19 Sep 2026 01:33:14 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 0B7FD5805C; Sat, 19 Sep 2026 01:33:14 +0000 (GMT) Received: from li-4c4c4544-0054-3910-8039-c3c04f423534.ibm.com.com (unknown [9.61.101.145]) by smtpav02.dal12v.mail.ibm.com (Postfix) with ESMTP; Sat, 19 Sep 2026 01:33:13 +0000 (GMT) From: Tyrel Datwyler To: james.bottomley@hansenpartnership.com, martin.petersen@oracle.com Cc: linux-scsi@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, brking@linux.ibm.com, davemarq@linux.ibm.com, Tyrel Datwyler Subject: [PATCH v2 05/20] scsi: ibmvfc: fix uninitialized _done dereference for TMF events on send failure Date: Fri, 18 Sep 2026 18:32:51 -0700 Message-ID: <20260919013306.2948028-6-tyreld@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260919013306.2948028-1-tyreld@linux.ibm.com> References: <20260919013306.2948028-1-tyreld@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTE5MDAxOCBTYWx0ZWRfX+yMQDyONwiPZ Sm5eopNHZjmWVaB+eJ9v2Zz2J60sTvRHPST+tbgw3xB0KN6HSwUwqDbxnUDQD/dmy98uHg092F6 kqOB1udtytYmgAgvxqAxXmRTQd21ynCJSokuvAVaPs7ZtWoylAHbQ9FQtafsRQ92gv1iAWu7SkW knZCngDRrruTG/L1Nc3FkiPrZDcNcBYsK4eQhQ/1MzHyosC/QFGWGnfuukAxX19oejDlDCbMjYl If3V6t9slChoQ8Pfr+T+MKJGrYxPze1oJm1k8gGyGZ5ea7y41tUyN/9LSDHYQyTOe44yds3Sfw2 T2X3aNyt7p+o6IVGCwjhzte4PGmoRD5+CI9R8zDbKgGbvpdiz8ZeAF5olSZ2q/6wiL3PRnmvh8R 2ChHfmlCG9VdGZSnSWvU2zl3lIQOI4c0/hTmug+hKBcQxVwDFSUoKtVqOvGZkCNS2Lrc3+lPHFE XmcIMETmOY26RMzBZxQ== X-Proofpoint-GUID: W6wdach4gRQIkxsnic1P5aaatOU6KHZ8 X-Proofpoint-ORIG-GUID: W6wdach4gRQIkxsnic1P5aaatOU6KHZ8 X-Authority-Analysis: v=2.4 cv=Q49HcI2a c=1 sm=1 tr=0 ts=6aade65c cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=IkcTkHD0fZMA:10 a=VdqzKS8jKosA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=VnNF1IyMAAAA:8 a=qtjYkiDot-WfiDIOCeAA:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 a=O8hF6Hzn-FEA:10 X-Proofpoint-Spam-Info: AW1haW4tMjYwOTE5MDAxOCBTYWx0ZWRfX5yue/bK/ZGZX ArNk3bPKGQLBwJ9IcwgpiQzwpseP8nAnSPNteWSrJRfkCkTDndA8CawJYW2HHKNBpMVHerfPMY+ 5QR9CJONGCaAC5QzKPryzKXgrAbvTNs= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-18_07,2026-09-16_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 bulkscore=0 suspectscore=0 spamscore=0 impostorscore=0 phishscore=0 malwarescore=0 clxscore=1015 adultscore=0 lowpriorityscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609190018 In ibmvfc_send_event(), the non-H_CLOSED error path uses a bare else clause to handle the case where evt->cmnd is NULL, assuming the event must be a MAD and reassigning evt->done =3D evt->_done before calling it. However, SCSI Task Management Function (TMF) events created by ibmvfc_init_tmf() are initialised with IBMVFC_CMD_FORMAT, not IBMVFC_MAD_FORMAT. ibmvfc_init_event() only populates evt->_done for IBMVFC_MAD_FORMAT events; for IBMVFC_CMD_FORMAT events evt->_done is never set. Since TMF events also have evt->cmnd =3D=3D NULL (cleared by ibmvfc_init_event()), they fall through to the bare else branch, copying the uninitialised evt->_done into evt->done and immediately calling it =E2=80=94 a wild function-pointer dereference that results in a kernel panic during SCSI error recovery under SAN error conditions. Fix this by replacing the bare else with 'else if (evt->crq.format =3D=3D IBMVFC_MAD_FORMAT)', gating the _done reassignment strictly on the MAD format where evt->_done is guaranteed to be valid. TMF events (IBMVFC_CMD_FORMAT, cmnd=3D=3DNULL) no longer reach this branch; their evt->done (ibmvfc_locked_done wrapping ibmvfc_sync_completion) remains correct as initialised, allowing the waiting ibmvfc_cancel_all_sq/mq paths to receive the completion normally. Fixes: 848c70852e3f ("ibmvfc: split NVMe support into separate source file = and add transport stubs") Signed-off-by: Tyrel Datwyler --- drivers/scsi/ibmvscsi/ibmvfc-core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/ibmvscsi/ibmvfc-core.c b/drivers/scsi/ibmvscsi/ib= mvfc-core.c index 728529155ded..e4a21ca6815d 100644 --- a/drivers/scsi/ibmvscsi/ibmvfc-core.c +++ b/drivers/scsi/ibmvscsi/ibmvfc-core.c @@ -1859,9 +1859,12 @@ int ibmvfc_send_event(struct ibmvfc_event *evt, evt->done =3D ibmvfc_vfc_eh_done; } else if (evt->fcp_req || evt->ls_req) { evt->done =3D ibmvfc_vfc_eh_done; - } else { + } else if (evt->crq.format =3D=3D IBMVFC_MAD_FORMAT) { evt->xfer_iu->mad_common.status =3D cpu_to_be16(IBMVFC_MAD_CRQ_ERROR); evt->done =3D evt->_done; + } else { + evt->xfer_iu->cmd.status =3D cpu_to_be16(IBMVFC_VIOS_FAILURE); + evt->xfer_iu->cmd.error =3D cpu_to_be16(IBMVFC_CRQ_FAILURE); } =20 evt->done(evt); --=20 2.55.0 From nobody Fri Sep 25 04:07:26 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C99293CC32E; Sat, 19 Sep 2026 01:33:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789781607; cv=none; b=q760nlQ2Zo4On3JaL9UoG1R5ivgDDdiJ84RZzDta/Dd8YLBKVo7pKD4XWl78sLTAn/0zCTawMd4FZl3WbCIqSlbrQ/YKT8U+8SHSAFnd9Lb7Co9i8Fni+TO+aPhf/rbeGL49ast4P0ZMakmjnzsZPDblKI85qfciSiiNJLuz0po= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789781607; c=relaxed/simple; bh=pxxcnXY0+hue1ldpYJe4b0dJH0KVEu5oUd8PZcc+kTk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=CRsVAGuqOE96C3No01v4/aasx1wq9JTKZJShfHNr9OkCmmdDx4kVmDJfjQg6ODtm1oujMgwHQXPxb8Ug5TsYP3dP+FJw4WTecwFgAkpqRJ2ALp0R929BOVDmRRdTjTANAZBXq2aO3ci797dloI495DsUY8ZifXaS7adKDuo/0mg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=CTlhCqXF; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="CTlhCqXF" Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68J1VnPA1676575; Sat, 19 Sep 2026 01:33:18 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=kBHt8BpvlOCU9iqJH JhW+RlT/TeDRrZPy1ETOcrXw5g=; b=CTlhCqXFzU0oS6/0bU+NLl8aIm+euZsHU puK3QpMd5JhC9/4+hHsXmexIKooYBIFdO3bYB1PQhoHbFXlA+K5fLbb6XFl4YIXX knKaBCc2FwdSxmqV0EJgT1ZwGDefr/Gh0ytJP55p4k6OCDVSYN9QFfSV3VY/JLZG O2ZYcZG5eVRzR06+6prC2f72GPDvh5rE3azzFrd6C8QvwChhM8mL43Cz9SUGHfV5 40WhMAYLavY5HrHqgfamnSV+JmcKH+I10lVBAB2mZ+tG09lSn/VAx6fXMDHAxbF1 mxQZ54pXhg/q2VmeYsdOZgCGWKyJnIGHYwwngeuF6bAAXkwDIW7vw== Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gsgtd803n-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Sat, 19 Sep 2026 01:33:17 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 68J1RlP91659398; Sat, 19 Sep 2026 01:33:17 GMT Received: from smtprelay01.wdc07v.mail.ibm.com ([172.16.1.68]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 4gsgrgg0cq-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 19 Sep 2026 01:33:17 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (smtpav02.dal12v.mail.ibm.com [10.241.53.101]) by smtprelay01.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 68J1XFF955378402 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 19 Sep 2026 01:33:15 GMT Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 64EA058051; Sat, 19 Sep 2026 01:33:15 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id C46755805A; Sat, 19 Sep 2026 01:33:14 +0000 (GMT) Received: from li-4c4c4544-0054-3910-8039-c3c04f423534.ibm.com.com (unknown [9.61.101.145]) by smtpav02.dal12v.mail.ibm.com (Postfix) with ESMTP; Sat, 19 Sep 2026 01:33:14 +0000 (GMT) From: Tyrel Datwyler To: james.bottomley@hansenpartnership.com, martin.petersen@oracle.com Cc: linux-scsi@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, brking@linux.ibm.com, davemarq@linux.ibm.com, Tyrel Datwyler Subject: [PATCH v2 06/20] scsi: ibmvfc: fix uninitialized shwqs in ibmvfc_purge_requests() Date: Fri, 18 Sep 2026 18:32:52 -0700 Message-ID: <20260919013306.2948028-7-tyreld@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260919013306.2948028-1-tyreld@linux.ibm.com> References: <20260919013306.2948028-1-tyreld@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTE5MDAxOCBTYWx0ZWRfX8OLIdcJgL3k9 QI/hViVuYIxbF0US0PKYrzI5PpQ1nP2lfUVtJlFkIrfDy6wpVoogbslsD3izA7lncu4PgXgAUcH Ig1zdi3w/SaPFCGC+UUeAKgVPWHUy9Ls1yztSRotAbKBBvDUmGOwOtfhPWSO6C6vN/R6JZzWcjr 91hhT5iuOGm83/HBrO1GI3C2r+lMb52p0pWA9JMHQlMiSYdu2ll6JAgaPUylZPLWd+naUcxdR+g QrOhJFbhUCO+fXrSPC+/Z40yZIl8hzSgIiCLbBlLDixVTGMLKkn0qkh2YittVJksNl1hm4hJ2az Alk6Va1YMTKg7xVQmOTBwA+Oj2btAQz7xSTXhvQtkAU/xJdwicmGLTlI1LYM396SqCuvk6BjE0t n9p/beI5cPBURYPgtBXn6pX8ZtV/Sq1xIYS6dY3dqsjnJlGj7cfu3Nvlkurkmxsb0SLyoyWT0WT bdfSD9q4iV1mt/2SjkA== X-Proofpoint-GUID: wmjiTiqsqXtEU21zBwXIjXUQYOEtu5ZJ X-Proofpoint-ORIG-GUID: wmjiTiqsqXtEU21zBwXIjXUQYOEtu5ZJ X-Authority-Analysis: v=2.4 cv=Q49HcI2a c=1 sm=1 tr=0 ts=6aade65d cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=VdqzKS8jKosA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=VnNF1IyMAAAA:8 a=6DixLaR-r_zTwfx8U4UA:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwOTE5MDAxOCBTYWx0ZWRfX0sXlOeAckxSd oyEuYgtsWg+uo9HIoOzzt8Y4ha1qiw7sY2tBAcSr4s/3pKhbJBTe3IxtaPm5y0TPbzDCcLE9QJT VyXGeLhC/MaSfXlGEB6xlLSqgtRXGy8= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-18_07,2026-09-16_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 bulkscore=0 suspectscore=0 spamscore=0 impostorscore=0 phishscore=0 malwarescore=0 clxscore=1015 adultscore=0 lowpriorityscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609190018 Content-Type: text/plain; charset="utf-8" In ibmvfc_purge_requests() the variables shwqs and nhwqs are declared as: int shwqs, nhwqs =3D 0; This initialises only nhwqs to zero; shwqs is left uninitialised. Both are assigned inside the 'if (vhost->using_channels)' block, so when using_channels is false the block is skipped and shwqs retains its garbage stack value. The subsequent loop for (i =3D 0; i < shwqs; i++) then iterates an arbitrary number of times over scsi_scrqs.scrqs[], which may be NULL on the non-channel path, resulting in out-of-bounds heap accesses and a kernel crash during any adapter reset or shutdown that occurs before channels are established. Fix by initialising shwqs to 0 in the declaration so that both loop bounds are zero when using_channels is false and neither sub-queue loop executes. Fixes: 4857949b58cd ("ibmvfc: fail nvme-fc fcp-io and ls requests during tr= ansport reset") Signed-off-by: Tyrel Datwyler --- drivers/scsi/ibmvscsi/ibmvfc-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/scsi/ibmvscsi/ibmvfc-core.c b/drivers/scsi/ibmvscsi/ib= mvfc-core.c index e4a21ca6815d..5ba8058991ef 100644 --- a/drivers/scsi/ibmvscsi/ibmvfc-core.c +++ b/drivers/scsi/ibmvscsi/ibmvfc-core.c @@ -1192,7 +1192,7 @@ static void ibmvfc_purge_requests(struct ibmvfc_host = *vhost, int error_code) struct ibmvfc_queue *scsi_q =3D vhost->scsi_scrqs.scrqs; struct ibmvfc_queue *nvme_q =3D vhost->nvme_scrqs.scrqs; unsigned long flags; - int shwqs, nhwqs =3D 0; + int shwqs =3D 0, nhwqs =3D 0; int i; =20 if (vhost->using_channels) { --=20 2.55.0 From nobody Fri Sep 25 04:07:26 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 512E23CB543; Sat, 19 Sep 2026 01:33:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789781606; cv=none; b=LgJnwO0X4GNcnMr5e8IkVDISatQ2RGO8sND1kJJOSL+sys0YzD3qQrI/L2uH8a7ovSXYJOgcnlwTxyfOkHU3pki1dHf6D43/ZvUW8qxi7y9C/16Ei7ZIX2Cwf3haUTo5+/Lqp8mbfhOezwpKGA4TUIIQxFXz9fesP5DmmgyYXJw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789781606; c=relaxed/simple; bh=jZcRCwwDd69i2azLP67GXsg/p2yrq6WX/ELNS5FuMNA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=taFlSecLC/VqnhXxHiv6mgj7pB+2RekDfPcFtp/rEidKm/ckrLt4BmrysohwwLHayaHRhNGWgI4kqxtP2K+lmbwoElkDh5s01CZPBZ+zeLkla2sIBgt+qoICvdHRfkKQGscwJ3r75B4Vy0SrQBA71AK03eGevkmZXKsSFY2s85A= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=PM+UuIWO; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="PM+UuIWO" Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68J01U2U2680639; Sat, 19 Sep 2026 01:33:18 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=UyEuUHJQNTzO2Papi 4WdL/3PgTbno1Y/3bvrorvVotA=; b=PM+UuIWODxlvetX3hjEM7QILiWAamavbj LsgKZRE4TXDMwb6Qa/jrztj8sdXhhjBSv2B0bo7beuZVIXJ2c99ROP//tvoYNhAZ rhJJd6wo1XPU1tP26Lsfbn4usL55ywd/gxBQiKnqrM4sMzWBY8LYcQSzjuWUVGfj DdMwKMNCaOjrSwkMNz+CqVxDTTcfu+zco4xPVvHlOH5XoMeFC5o6UYNmPlcSrkzk fMQsF1cxxldHvroGh2egIUlSXYtdtV2p73K9UEmeQx6E3i8/KfDoN0AZtxYUPeQn C25PhVJgvUSq7Mowaypj5Hdx2sNiF9P0l/bftd5qoA4/gvw6dyMWQ== Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gmxf5k1tw-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Sat, 19 Sep 2026 01:33:18 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 68J1QlXH1584848; Sat, 19 Sep 2026 01:33:17 GMT Received: from smtprelay02.wdc07v.mail.ibm.com ([172.16.1.69]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4gsgr2r0es-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 19 Sep 2026 01:33:17 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (smtpav02.dal12v.mail.ibm.com [10.241.53.101]) by smtprelay02.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 68J1XGQM26870276 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 19 Sep 2026 01:33:16 GMT Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 2847858051; Sat, 19 Sep 2026 01:33:16 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 810165805A; Sat, 19 Sep 2026 01:33:15 +0000 (GMT) Received: from li-4c4c4544-0054-3910-8039-c3c04f423534.ibm.com.com (unknown [9.61.101.145]) by smtpav02.dal12v.mail.ibm.com (Postfix) with ESMTP; Sat, 19 Sep 2026 01:33:15 +0000 (GMT) From: Tyrel Datwyler To: james.bottomley@hansenpartnership.com, martin.petersen@oracle.com Cc: linux-scsi@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, brking@linux.ibm.com, davemarq@linux.ibm.com, Tyrel Datwyler Subject: [PATCH v2 07/20] scsi: ibmvfc: fix uninitialized status logged on LS abort send failure Date: Fri, 18 Sep 2026 18:32:53 -0700 Message-ID: <20260919013306.2948028-8-tyreld@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260919013306.2948028-1-tyreld@linux.ibm.com> References: <20260919013306.2948028-1-tyreld@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: 8Q4wT0M_BTUg3W3Y2PrEHToNSCHh8qgs X-Proofpoint-Spam-Info: AW1haW4tMjYwOTE5MDAxOCBTYWx0ZWRfX/MdtJ5bZKHyE 3xzrZTgTD4JPhTVtdywKF8IQZ6PSt60UQlU0NHsdZqk5C57QiEDevG+SuJPvVb0jLVyN1v6/R2p hAJ1Uf3hcePEhPMJg6IrIaDyBiHaKlY= X-Authority-Analysis: v=2.4 cv=cvgOAF4i c=1 sm=1 tr=0 ts=6aade65e cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=VdqzKS8jKosA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=U7nrCbtTmkRpXpFmAIza:22 a=VnNF1IyMAAAA:8 a=dm6BVu0w9rUwWJiP_yAA:9 X-Proofpoint-ORIG-GUID: 8Q4wT0M_BTUg3W3Y2PrEHToNSCHh8qgs X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTE5MDAxOCBTYWx0ZWRfXxkVnIrmg5MIU xdlbQbsdCmAH+ciCLd8cyhBsMPZrOCgU009p9hkFgLfZKxiT5jx0RBU98f1bZ7GbhY0EMXMwT9e TcElrUElwOCWmLWs3vIkiWM/Tu6ntPv/bonE6aiggWK5VgSsSItq7wfZBb8jJoSM4VRNwT+FVaG OUXKIufd/jHHk30tLZ8Mm+hTie1Zksze0j3hRQ4mym23N/92V4jIsU2QmtcGBemBNhc4c0ow8aY aFj7FN77XhpedYSb1dGVVq4HvSn/OEsZ3iEeJn8FIf1dvYLJV14Em+ifoYORwSTif6/tSxt3fx7 wlDD2UQiUKlWMWmGQ6A9+5EaZzbpt9zFUxBz8rUVGif3Y3TF2AUq3EReqDMB8iMzcDTVf7XNgdv GrVkNvZ6u03cBJ6kl+sQBSrz3Ccbg1DnpmGhVfWwdSwuREkX2mHkYnKbgUqCK6qUFmzFrkoF/GD 9b53z2K064Y7ywLg/tA== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-18_07,2026-09-16_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 lowpriorityscore=0 clxscore=1015 priorityscore=1501 suspectscore=0 bulkscore=0 impostorscore=0 phishscore=0 spamscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609190018 Content-Type: text/plain; charset="utf-8" In ibmvfc_nvme_ls_abort(), 'status' is declared without an initialiser. It is only assigned at line 223 on the ibmvfc_send_event() success path: wait_for_completion(&evt->comp); status =3D be16_to_cpu(rsp.mad_common.status); When ibmvfc_send_event() fails the code jumps via 'goto out', skipping the assignment entirely. The ibmvfc_dbg() call that immediately follows the out: label then reads uninitialised stack memory and logs a meaningless status value. Fix by initialising status to IBMVFC_MAD_CRQ_ERROR at its declaration. This sentinel accurately reflects that the underlying CRQ send failed and produces a meaningful log message on the error path. Fixes: 20bec08f0208 ("ibmvfc: implement nvme-fc LS abort handling callback") Signed-off-by: Tyrel Datwyler --- drivers/scsi/ibmvscsi/ibmvfc-nvme.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/scsi/ibmvscsi/ibmvfc-nvme.c b/drivers/scsi/ibmvscsi/ib= mvfc-nvme.c index 08dd897b8e64..0391fdb4642d 100644 --- a/drivers/scsi/ibmvscsi/ibmvfc-nvme.c +++ b/drivers/scsi/ibmvscsi/ibmvfc-nvme.c @@ -202,7 +202,7 @@ static void ibmvfc_nvme_ls_abort(struct nvme_fc_local_p= ort *lport, struct ibmvfc_event *evt; union ibmvfc_iu rsp; unsigned long flags; - u16 status; + u16 status =3D IBMVFC_MAD_CRQ_ERROR; =20 evt =3D ibmvfc_get_event(&vhost->crq); if (!vhost->logged_in || !evt) --=20 2.55.0 From nobody Fri Sep 25 04:07:26 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DF4013CC7EB; Sat, 19 Sep 2026 01:33:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789781607; cv=none; b=mlDPp22a0ySwS43bSrk2NXolodqiCJj8Nus544ZqV7X9vcPfnm4YmM3GernfM0cn7OPZlsF4v+dq8/DV2lSKRQ09hnYARJt04EYLiXvpemN3YuonuxHdhAr5bs68memfJ7p36gHLosxts/4ghz/ihHW4YhIkB6P/LRTGtrB1K/w= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789781607; c=relaxed/simple; bh=G/KdWH0LXWh5PyYtHCfZlqMtt5iGwmwCW3WoZKhrm4k=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=s0FZr64dhqefIBWnwBL4MPQ2MQaFKe/X20bZbu1kcQWSssPFlDwjTHHypVFN81Nu53hpJu9T+GETCLNVo2+sRqkWv9WohZTe73JagxryXhtzmVKZj/17A7W6EvDtZXeg43V1XIuU+n9z5F7tICiz4ibluKZ/CUjj2KZ7XNgYoYc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=e8SbRvLK; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="e8SbRvLK" Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68J01b542680724; Sat, 19 Sep 2026 01:33:19 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=Q/epBG4Ib5i0S5+W8 2s+9IpRYqugI0agn8sH+YnW6QM=; b=e8SbRvLKH3ER/faOqVE0pnpAokTE+Voxm LyifSWHNCdndcdJ68DBeWHm0oz2Rztt+BO+BQHIqNRqLFp+fDKjd8zw/3zVQGyyP qY+ENwPwLVDc6sJScjR7wdniMgGD9nK/3eUICsno7ibp2ZKve/vtmH2sEdfTupI3 fBzy53RbnKPNJJW+nyJbLEFnZtmjmYSorVYijUI0/CgK9hPDvpW1Q3c0QvkwhiqM s5VfJGcvhWO9jvWLRd7eX9BPWicZsKZdA29bQCzhJgYS9HaGtZ+k/GTJuX/24TL+ UIy07pnHxMvJOy2Pc0HkYtn277OD5+h+8VF5sBkLRPNKujsT0wvBg== Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gmxf5k1tx-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Sat, 19 Sep 2026 01:33:19 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 68J1RaOY1658899; Sat, 19 Sep 2026 01:33:18 GMT Received: from smtprelay03.wdc07v.mail.ibm.com ([172.16.1.70]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 4gsgrgg0cr-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 19 Sep 2026 01:33:18 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (smtpav02.dal12v.mail.ibm.com [10.241.53.101]) by smtprelay03.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 68J1WYC529098666 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 19 Sep 2026 01:32:34 GMT Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id E5EDB58051; Sat, 19 Sep 2026 01:33:16 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 4678E5805A; Sat, 19 Sep 2026 01:33:16 +0000 (GMT) Received: from li-4c4c4544-0054-3910-8039-c3c04f423534.ibm.com.com (unknown [9.61.101.145]) by smtpav02.dal12v.mail.ibm.com (Postfix) with ESMTP; Sat, 19 Sep 2026 01:33:16 +0000 (GMT) From: Tyrel Datwyler To: james.bottomley@hansenpartnership.com, martin.petersen@oracle.com Cc: linux-scsi@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, brking@linux.ibm.com, davemarq@linux.ibm.com, Tyrel Datwyler Subject: [PATCH v2 08/20] scsi: ibmvfc: fix inverted suppress-ABTS capability check in NVMe TMF path Date: Fri, 18 Sep 2026 18:32:54 -0700 Message-ID: <20260919013306.2948028-9-tyreld@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260919013306.2948028-1-tyreld@linux.ibm.com> References: <20260919013306.2948028-1-tyreld@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: 8W4TuUHt2lS9V9GXxJUEeWW2WnEnskuW X-Proofpoint-Spam-Info: AW1haW4tMjYwOTE5MDAxOCBTYWx0ZWRfX4EDCIOQCWH9c v7q9Cj0HxkTcqdQVgKsZXcq1JnLmo06PJlynUELC6NphNQyzaefcxfnFJVQLPCdSFt1zfM7mD4q Rj6TLSIZYDuNU2jcsjpa2beuhFoODgo= X-Authority-Analysis: v=2.4 cv=cvgOAF4i c=1 sm=1 tr=0 ts=6aade65f cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=VdqzKS8jKosA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=U7nrCbtTmkRpXpFmAIza:22 a=VnNF1IyMAAAA:8 a=4DjNXy2qQgjy61e-tjkA:9 X-Proofpoint-ORIG-GUID: 8W4TuUHt2lS9V9GXxJUEeWW2WnEnskuW X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTE5MDAxOCBTYWx0ZWRfX4LbNS8mGiEDY 4VpNIthCeMUTk6YqCglDiAeEaBJZMSTpSts9hnI8rYqaKylfMplU7vFU6OCO4ZxkxEe1B76cHg2 rwrbnpQvYdY3EC5sm6YAy/Gp+7CrSK5EbFWD1Ovxt85sq6G3cQTBDpkZBUTYMm9qEQhgeS5C58i 9iDVLLZGVqv7Q/M/DBuZUg2ExVEbSrBMkTWjOtQbVGA9mZjb3lWb0da5gSl2mCM7ENJQ78jPdoU fi80eL7g4Z5e+yKjEi0vtr7vpNE7aa5secPs+QzrhaCbN5LRsjjtU1vdlNCAthV559VXCH8Ywqi CWTAVx6WGE2nUSyAiyTkVKqIJBv8/RSt/81jFc5IwX+z+133sVtmLbGyHZOB8JflwIM5GLsrPXR dVuxbAjz4G/NbVmO3+HHp2zpktIFGFonLaGw45+pDz+3lrS0btXzRvSlgYltXidB23FrrHV1aVm cSTtbcrwHl9b7sSJE2A== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-18_07,2026-09-16_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 lowpriorityscore=0 clxscore=1015 priorityscore=1501 suspectscore=0 bulkscore=0 impostorscore=0 phishscore=0 spamscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609190018 Content-Type: text/plain; charset="utf-8" ibmvfc_nvme_setup_fcp_abort() sets the IBMVFC_TMF_SUPPRESS_ABTS flag only when the adapter does NOT have the IBMVFC_CAN_SUPPRESS_ABTS capability, which is the exact opposite of the intended behaviour. Remove the erroneous '!' negation so the flag is set when the adapter actually reports the capability, consistent with how the SCSI TMF path in ibmvfc_cancel_all() handles the same check. Fixes: 20bec08f0208 ("ibmvfc: implement nvme-fc LS abort handling callback") Signed-off-by: Tyrel Datwyler --- drivers/scsi/ibmvscsi/ibmvfc-nvme.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/scsi/ibmvscsi/ibmvfc-nvme.c b/drivers/scsi/ibmvscsi/ib= mvfc-nvme.c index 0391fdb4642d..58e3e50d0c5c 100644 --- a/drivers/scsi/ibmvscsi/ibmvfc-nvme.c +++ b/drivers/scsi/ibmvscsi/ibmvfc-nvme.c @@ -184,7 +184,7 @@ static void ibmvfc_init_ls_abort(struct ibmvfc_event *e= vt, struct nvmefc_ls_req tmf->common.opcode =3D cpu_to_be32(IBMVFC_NVMF_TMF_MAD); tmf->common.length =3D cpu_to_be16(sizeof(*tmf)); if (vhost->state !=3D IBMVFC_ACTIVE) - if (!ibmvfc_check_caps(vhost, IBMVFC_CAN_SUPPRESS_ABTS)) + if (ibmvfc_check_caps(vhost, IBMVFC_CAN_SUPPRESS_ABTS)) tmf->flags =3D cpu_to_be32(IBMVFC_TMF_SUPPRESS_ABTS); tmf->cancel_key =3D cpu_to_be32((u64)abt_evt); tmf->my_cancel_key =3D cpu_to_be32((u64)evt); --=20 2.55.0 From nobody Fri Sep 25 04:07:26 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 461683D093A; Sat, 19 Sep 2026 01:33:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789781609; cv=none; b=GzrOCrU6Jih7kfgCHPx4QLZpzT7T4D9b/gR8DDK5qTxrJ4nW1mc2/5CEaLCqL7QqwfATEs0rm0Me5eKKkifXfNDBoWXKNQZTnOrsYEiLpj/0x0Kp5JVeDBJFaBz+TOTtiQfujxqanOeqLkbRgZCKtlteKDa3pMKlxChLYrM4NPU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789781609; c=relaxed/simple; bh=1v+B61qectOfATj4wDOKlDSAoMNZ8igm2c94UBM6p6o=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=BPunJ/iXjbpXHjagMJiT29y2aVZHErq/tfV3/AcOHHwur5TlhIyyQpwuag+fBu5NQvA7hR3uUZx+wgDMnOKRU7JyVtxg746+EDNLlpHLAfwEzlLAAu3HarTt7uZ5h6j4/SHr4fcWMZ2HDQi8/roQEo0cxZ2RagiPyKyYYTfDYJU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=kICrviCF; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="kICrviCF" Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68J0Nv9c2565988; Sat, 19 Sep 2026 01:33:20 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=9brRyILqr21NfsPun JSLVDDhoEO0fDeyEFwXk4ednRM=; b=kICrviCFuVEtvrmGgIe+KXePRit7e1aHE Ur2nvazJPjgfwj/2PgMmQHncPPl53m1DFVIQx7J9e7UxxX/0idSa2cL5DXoXt3nc Dpr/5XJB/ZxvX1NvGkAjMcnhwRUGyB1pfPgZ0/YUbhf2R6G94EM00+l51qRJevEA lVFyO4zuhOX3BPUHeb4Boh8Ytq9EIsROsap3bAsFj+ZR4IrZ91yzYEN1tVJd2O2/ uiakSGXzQVQDBcqTW2z0L/EqIXsuemhcZM6sXljcarFWrZU+eU9sHjlxOc+Y9yAf GBrulwhee5NG8DFJ9XFaq6li/hA8Whh4KEZFmQKcBjYPGw+8zwczg== Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gsftk04hg-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Sat, 19 Sep 2026 01:33:20 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 68J1PmMf1662748; Sat, 19 Sep 2026 01:33:19 GMT Received: from smtprelay03.wdc07v.mail.ibm.com ([172.16.1.70]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4gsgqn00fm-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 19 Sep 2026 01:33:19 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (smtpav02.dal12v.mail.ibm.com [10.241.53.101]) by smtprelay03.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 68J1WYhF29098668 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 19 Sep 2026 01:32:35 GMT Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id B234558051; Sat, 19 Sep 2026 01:33:17 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 109F45805A; Sat, 19 Sep 2026 01:33:17 +0000 (GMT) Received: from li-4c4c4544-0054-3910-8039-c3c04f423534.ibm.com.com (unknown [9.61.101.145]) by smtpav02.dal12v.mail.ibm.com (Postfix) with ESMTP; Sat, 19 Sep 2026 01:33:16 +0000 (GMT) From: Tyrel Datwyler To: james.bottomley@hansenpartnership.com, martin.petersen@oracle.com Cc: linux-scsi@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, brking@linux.ibm.com, davemarq@linux.ibm.com, Tyrel Datwyler Subject: [PATCH v2 09/20] scsi: ibmvfc: fix infinite reset loop on NULL evt in implicit logout path Date: Fri, 18 Sep 2026 18:32:55 -0700 Message-ID: <20260919013306.2948028-10-tyreld@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260919013306.2948028-1-tyreld@linux.ibm.com> References: <20260919013306.2948028-1-tyreld@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: 50B31vID0Y6sRvubIVPBaOC66sS7Br0W X-Proofpoint-Spam-Info: AW1haW4tMjYwOTE5MDAxOCBTYWx0ZWRfX4fvr7XGU8fAV KJ6kt9KZ5NVTCst8gqsoSRArThQQCvuVekaipn30eSwcFPYCAp7WYlDHK6BBGjHX54HS73fZYsD z/0DTYzamYC6HlvuDzDXjj0Ma9d9jP8= X-Authority-Analysis: v=2.4 cv=EMaTQFZC c=1 sm=1 tr=0 ts=6aade660 cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=VdqzKS8jKosA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=Y2IxJ9c9Rs8Kov3niI8_:22 a=VnNF1IyMAAAA:8 a=b_dQgyAL5RWhf91NP5kA:9 X-Proofpoint-ORIG-GUID: 50B31vID0Y6sRvubIVPBaOC66sS7Br0W X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTE5MDAxOCBTYWx0ZWRfX6FH9HO0uq2f4 KHHIOkI9h755jPkiRkoeBCiYf8ZpdAc2Lu1pKG/tWnnrcCLYkwUjs+YtrkVPopUXEJUoXkfvQgc blN6PCOqpI6OO5edU3NSRUipM1hKPtbWAUGUjCfiRxI4+5doEcEQr/6ELJrRd/PGAXpPyrLWcZj lX5qS13v/IZmHab2jm0rCmZFX5qGl4JVjQi47UYn0wTvw0w88AxoMm6NO7QQcGlXKPFZUfr4Vcs MVp6oYRPBBn+SKsCL7yOZIVQw+rLbLB6OtQ89BDC/RRdmrmJi0JFl2AJ0m65j2XzYzkZ9YWSRci aVvewPmWlui5b3dhwhKQqwbCTtcn0OxSgH/vziVzeV0m7jGzf/T6rf+LrGaXf9j123et6ZCrTvr bc5sM9E8+jQ0ftSUxdLM6ocAXtCDz3JOvbPzNp8RTbM0/o7EXYjNiY2ytAF87k9TCsZ9LYk8XVr 4iATlEQZnKBd/DoN5kg== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-18_07,2026-09-16_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 spamscore=0 impostorscore=0 bulkscore=0 priorityscore=1501 lowpriorityscore=0 phishscore=0 adultscore=0 suspectscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609190018 Content-Type: text/plain; charset="utf-8" ibmvfc_tgt_implicit_logout_and_del() calls ibmvfc_set_tgt_action() with IBMVFC_TGT_ACTION_NONE in the NULL evt error path. However the state machine in ibmvfc_set_tgt_action() explicitly handles LOGOUT_RPORT and only permits transitions to LOGOUT_RPORT_WAIT or DEL_RPORT from that state; NONE is silently rejected and returns -EINVAL, leaving the target stuck in LOGOUT_RPORT. With the target permanently in LOGOUT_RPORT, ibmvfc_dev_logo_to_do() keeps returning 1, causing the host to spin in an infinite reset loop. Use IBMVFC_TGT_ACTION_DEL_RPORT instead, which is the same transition taken by the !vhost->logged_in early-exit path in the same function and is the correct valid transition to unblock target cleanup. Fixes: 0122eab60b15 ("ibmvfc: check for NULL evt in implicit LOGO and targe= t delete path") Signed-off-by: Tyrel Datwyler --- drivers/scsi/ibmvscsi/ibmvfc-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/scsi/ibmvscsi/ibmvfc-core.c b/drivers/scsi/ibmvscsi/ib= mvfc-core.c index 5ba8058991ef..70771f6420d9 100644 --- a/drivers/scsi/ibmvscsi/ibmvfc-core.c +++ b/drivers/scsi/ibmvscsi/ibmvfc-core.c @@ -4545,7 +4545,7 @@ static void ibmvfc_tgt_implicit_logout_and_del(struct= ibmvfc_target *tgt) =20 if (!evt) { vhost->discovery_threads--; - ibmvfc_set_tgt_action(tgt, IBMVFC_TGT_ACTION_NONE); + ibmvfc_set_tgt_action(tgt, IBMVFC_TGT_ACTION_DEL_RPORT); kref_put(&tgt->kref, ibmvfc_release_tgt); __ibmvfc_reset_host(vhost); return; --=20 2.55.0 From nobody Fri Sep 25 04:07:26 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C745F3CBE79; Sat, 19 Sep 2026 01:33:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789781609; cv=none; b=MWj6c1r4vRTcezx8Qngn/DZDtQ1/LVjGUKkDngVuB5PsjkhFScvammNInbYOC1kFcn4FIjtqfti8U4XV1uU19VaiuvcZeZVnT94tXJY3sZO74NW6i+Kq+xCPcePJ9RGTbxrPgpSK6aFwQDSHaRs2M7p018TPE4ZOwtzfEmpA+0M= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789781609; c=relaxed/simple; bh=8hC9HjshbaWifWt97tUS0S3bD/vwxwFndUkXceLwBl0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=sirese3ZOcWuKsAtD3jiCHOSJLGtjpsRA0uPbwLdY6J+nuHCR+ihCN25pR5ctqMtxDGozya00GwUuiCT30Mg/9AS5xNLSWM2nn6RL4lpx2nOZBE6kfYxWZkFtYof4aAYd4KRTrKwFxas0OICiHSSQQTG84trcHOTBMfJhpW1FZo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=rJdhthEA; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="rJdhthEA" Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68J0NwIr2566069; Sat, 19 Sep 2026 01:33:20 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=cZdqTE0tCATjfIVYR rm9i0hUu5Zyah3yiFzKFjTCx6E=; b=rJdhthEA5AVxmiujsNBzoYZd85/HSYAXM NC9qk7/3AKCU4XSer4tECGluTeVsXTgtFL/UwvYSTDXp7V9CxoZVuzVe9U7N9x/t epRvKnQEMxp0zW2eYwywIlz8AL7mM9z8MjTzlNh8Yt8aLAxEMusr1s2AItXXKYHL 0pdFZquYxqWR2VNIRUoN+xcZTngvEKCmUfNXz5SRZxCxO8IVK74HV1Z/YxS4bZol u/0exK/NaNQq1F4hJQ3Hj1DFxkClhqMP7E0xsMsZ3hAVW1NhLPkP5Jl+AVCrQF90 QWSUEZIEc6H2o/gtZY3Kq+C1n7YUFQtQVVqU9iPF8fl66NIU7ExGw== Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gsftk04hh-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Sat, 19 Sep 2026 01:33:20 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 68J1Qnha1584893; Sat, 19 Sep 2026 01:33:19 GMT Received: from smtprelay04.wdc07v.mail.ibm.com ([172.16.1.71]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4gsgr2r0eu-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 19 Sep 2026 01:33:19 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (smtpav02.dal12v.mail.ibm.com [10.241.53.101]) by smtprelay04.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 68J1XIlY40960730 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 19 Sep 2026 01:33:18 GMT Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 7943C58051; Sat, 19 Sep 2026 01:33:18 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id CFC465805A; Sat, 19 Sep 2026 01:33:17 +0000 (GMT) Received: from li-4c4c4544-0054-3910-8039-c3c04f423534.ibm.com.com (unknown [9.61.101.145]) by smtpav02.dal12v.mail.ibm.com (Postfix) with ESMTP; Sat, 19 Sep 2026 01:33:17 +0000 (GMT) From: Tyrel Datwyler To: james.bottomley@hansenpartnership.com, martin.petersen@oracle.com Cc: linux-scsi@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, brking@linux.ibm.com, davemarq@linux.ibm.com, Tyrel Datwyler Subject: [PATCH v2 10/20] scsi: ibmvfc: fix u16 overflow of max_cmds in ibmvfc_set_login_info() Date: Fri, 18 Sep 2026 18:32:56 -0700 Message-ID: <20260919013306.2948028-11-tyreld@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260919013306.2948028-1-tyreld@linux.ibm.com> References: <20260919013306.2948028-1-tyreld@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: vg-10DWfbcuTeC2dp-uSmuo5oKsiOAge X-Proofpoint-Spam-Info: AW1haW4tMjYwOTE5MDAxOCBTYWx0ZWRfXz09b4YbXokaz MC7fIL9byxLyMHa5fVdbMltqNG+ivIJFQOmnBxwwbvIVh7/GKLWoCE2xIxRn43YPjwTRsvnR3By /91Kt4srNjJPX6GVBMcdZ3b7MwAryJ0= X-Authority-Analysis: v=2.4 cv=EMaTQFZC c=1 sm=1 tr=0 ts=6aade660 cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=VdqzKS8jKosA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=Y2IxJ9c9Rs8Kov3niI8_:22 a=VnNF1IyMAAAA:8 a=oS3JfTuPRayek_SdIqsA:9 X-Proofpoint-ORIG-GUID: vg-10DWfbcuTeC2dp-uSmuo5oKsiOAge X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTE5MDAxOCBTYWx0ZWRfX0zdGCPKESEke AJ+lKJuDEyRTA7jcSXYyIXU77D+YW4m3w/Xf7YmVE23PKmHguO4PcPJ610/tk1eXHFbcQTZhdBh bOwPozo5EvwRAN68F2sIt1/3ByHKflXEa6wx1ajfjVXOrUJBuHyH72Rgz6TgWIQBGSnzPKbAsmM imRGCwAYRUc64fgKxt9+oOnwPX2ArhaEeytfOzo9b9nNEmHwfdMVWrviWxNFSrFmfq9ULxW3ZkZ 1IryRiBTyCB1UZt9rcCOiIFw16ct9nKF0oYYM7dZvvYyyzFk//Tzc0CJk3RCuIi0ty1fbrcYmqO BaCoN9Gsowf2D8mCUe7gOAdYZ3uKTQVzQBLDlFuXWPVly63k331jraOiEgkliZQnDHC7O7HrRza qMBVTVom2Ge/qZo4TJi5jocXcx143cET0fV/wp9PYEBf8Xr9e7dgwZgA4VyPXaewxwsXUz+eq2F M1Yfwj4AsTAX0643/EQ== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-18_07,2026-09-16_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 spamscore=0 impostorscore=0 bulkscore=0 priorityscore=1501 lowpriorityscore=0 phishscore=0 adultscore=0 suspectscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609190018 Content-Type: text/plain; charset="utf-8" max_cmds is declared as u16 but the calculation: scsi_qdepth + IBMVFC_NUM_INTERNAL_REQ + (scsi_qdepth + IBMVFC_NUM_INTERNAL_SUBQ_REQ) * (scsi_scrqs.desired_queues + nvme_scrqs.desired_queues) can exceed 65535 at non-extreme configurations. With scsi_qdepth=3D2048 and 32 total desired queues (16 SCSI + 16 NVMe maximum), the subqueue term alone evaluates to 2052 * 32 =3D 65664, which silently wraps to 128 in a u16, causing the NPIV login MAD to advertise a badly corrupted command slot count to the VIOS. The wire field login_info->max_cmds is already __be32, so widen the local variable to u32 to match, making the arithmetic safe across all supported module parameter combinations. Fixes: ecc03d958e37 ("ibmvfc: add logic for protocol specific fabric logins= ") Signed-off-by: Tyrel Datwyler --- drivers/scsi/ibmvscsi/ibmvfc-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/scsi/ibmvscsi/ibmvfc-core.c b/drivers/scsi/ibmvscsi/ib= mvfc-core.c index 70771f6420d9..623fff503040 100644 --- a/drivers/scsi/ibmvscsi/ibmvfc-core.c +++ b/drivers/scsi/ibmvscsi/ibmvfc-core.c @@ -1566,7 +1566,7 @@ static void ibmvfc_set_login_info(struct ibmvfc_host = *vhost) struct ibmvfc_queue *async_crq =3D &vhost->async_crq; struct device_node *of_node =3D vhost->dev->of_node; const char *location; - u16 max_cmds; + u32 max_cmds; =20 max_cmds =3D scsi_qdepth + IBMVFC_NUM_INTERNAL_REQ; if (mq_enabled) --=20 2.55.0 From nobody Fri Sep 25 04:07:26 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DC3F638D3E2; Sat, 19 Sep 2026 01:33:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789781610; cv=none; b=JwOVHaLiNW5CIuxqUXy5xJT04j0bWNKayZ49Z0je7lkNC+nyCd31nn3dCNfXXIY628shPyTpciZSP4mBBmfjpVs1AvLw73Z/tZkAoi7S7ZVDueMKFho+verYmrZGspWBqnqxiFlNnKLoWGqxkcg2hl4wF79TkiVu5dlwclg7F+I= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789781610; c=relaxed/simple; bh=Ij5VwwdlD8mJy+tK/8w/h56u56NGyOSDleALMcqOj2k=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=HhBMReGjCuVPkiGPfSH6DoJVPvhUsFoz4loado5ujw+qQvvHOK5PPBlAMMYYcQ4SVZLuZMLe3KGh0Ns9MmYXJKdjVSqbTTG7fmfbc7h5ZjWIZlcOFdxrFfmauTvmO55o4iUY9KeIinyx7CHi57jgQzmUGj6vfxTgmh7leICNQ0I= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=JYH24ieI; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="JYH24ieI" Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68J01pJj2707060; Sat, 19 Sep 2026 01:33:21 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=pp1; bh=UMdifT 5cjTUVtdlRLrZWhP9oOLrPKfWFwvBJO5bk5qk=; b=JYH24ieIY0qj9jNygGV4pU lqnt0riFB+I/90Z87eTgzcuBFiCHy4Qc6iiXqbkw3pRaeRvlbcaGeB2A4IdugRac iglWa7ZRTr101HGSfcA3EN29B0fAZ1/FCXsCvAtcF/Ln40F6fqLkAJAz1+eKo4M9 u0YEdGxtQdEl7ViJzE94SunDn8CuKw5uHuvG23POnZEoZDZrHjYKusvV+aYZ3efz E66ZuSk63ScCu0THWbn+uva2iTdq/70y5TK+klloA3ph7YcDsSF8O3jfDIyVti3t SIWrGD3Fwa+0GVhkiq58KQ+vj/gcFbh4DNo3oPYPJFABdQDDA7vRkEFYwlyZHwEw == Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gmxcvj9mh-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Sat, 19 Sep 2026 01:33:20 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 68J1UiQr2575638; Sat, 19 Sep 2026 01:33:20 GMT Received: from smtprelay03.dal12v.mail.ibm.com ([172.16.1.5]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4gsgssg06h-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 19 Sep 2026 01:33:20 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (smtpav02.dal12v.mail.ibm.com [10.241.53.101]) by smtprelay03.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 68J1XJ7p33948240 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 19 Sep 2026 01:33:19 GMT Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 46C2358051; Sat, 19 Sep 2026 01:33:19 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 983E05805A; Sat, 19 Sep 2026 01:33:18 +0000 (GMT) Received: from li-4c4c4544-0054-3910-8039-c3c04f423534.ibm.com.com (unknown [9.61.101.145]) by smtpav02.dal12v.mail.ibm.com (Postfix) with ESMTP; Sat, 19 Sep 2026 01:33:18 +0000 (GMT) From: Tyrel Datwyler To: james.bottomley@hansenpartnership.com, martin.petersen@oracle.com Cc: linux-scsi@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, brking@linux.ibm.com, davemarq@linux.ibm.com, Tyrel Datwyler Subject: [PATCH v2 11/20] scsi: ibmvfc: fix UAF and hang in ibmvfc_cancel_all_mq() on send failure Date: Fri, 18 Sep 2026 18:32:57 -0700 Message-ID: <20260919013306.2948028-12-tyreld@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260919013306.2948028-1-tyreld@linux.ibm.com> References: <20260919013306.2948028-1-tyreld@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Info: AW1haW4tMjYwOTE5MDAxOCBTYWx0ZWRfX+vd2ak2XlJOl zQpY4RmCrQ2BfgaNoXIvHB/ZFZ8x9lwe8K5bKCBG6FgnCrb9DIKcHytmB2RlHakhi0zLZ1BCG4z MxZ7amptCe0crTlwp4V1bMu6ypS15dA= X-Proofpoint-ORIG-GUID: Ld4m8zdCWjhUiLT8UkVK58QbHfD6ESs9 X-Proofpoint-GUID: Ld4m8zdCWjhUiLT8UkVK58QbHfD6ESs9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTE5MDAxOCBTYWx0ZWRfX815Uw9NBDHOA O/UQ4qolhx4qJbWvIN2bvTC+zwIMy2wGQ6OwXgybiGppPGeZqNWn66V6M1kP+L5izcOBB53kWrh orQeppM6CdHSHnQG8P+8SSy2Cg00iLsbq5JJtau9iXhk++KLWG+Parv+tk5aXyO39YDU8fXU7ae oql63NFVbg8Gvl3pPYIqk0xIrGbkoQnVRoHCyzEmnAoyo87wvddil9OIBNZwlRsB+Anh66/QmT5 w1K6cXSAuv/jJC+uLwiR2y/hoPRc5vMBDVPyW/eCSeAa5QcEGS0yX9RLVTdUyMGpKzaqdzo7cR6 Ewtv23B7uc2v1qUmexRCHZN0U7+6/izz9mLu29OQsIqqTcjMewAUNK0lxTPnYEMCCb4h6dPCrPo xg2ik2Cfm/wIjK7KX8rI28jM8PCskzQzZ9OaWVZspJ72Z9sGpsqJXQCtBzKYo2bbA8xQe4xr5xS X0W7SZRzAToxhX6zTiA== X-Authority-Analysis: v=2.4 cv=F+7C5ahN c=1 sm=1 tr=0 ts=6aade660 cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=IkcTkHD0fZMA:10 a=VdqzKS8jKosA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=RzCfie-kr_QcCd8fBx8p:22 a=VnNF1IyMAAAA:8 a=nlcoev9x_0hUi8ert_4A:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-18_07,2026-09-16_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 suspectscore=0 phishscore=0 clxscore=1015 malwarescore=0 lowpriorityscore=0 bulkscore=0 spamscore=0 impostorscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609190018 ibmvfc_cancel_all_mq() discards the return value of ibmvfc_send_event(). When ibmvfc_send_event() fails due to H_CLOSED it internally frees the event before returning SCSI_MLQUEUE_HOST_BUSY. The caller then performs list_add_tail() on the freed event =E2=80=94 a use-after-free =E2=80=94 and= subsequently blocks indefinitely on wait_for_completion(&evt->comp) for a completion that will never arrive. Fix by capturing the return value. On failure, drop the locks, log the error (consistent with ibmvfc_cancel_all_sq()), drain and free any cancel events already queued from earlier loop iterations, then return 0. Returning 0 on send failure is correct: when the adapter closes the CRQ the firmware delivers a transport event through ibmvfc_handle_crq() which completes all outstanding commands, so the error recovery caller will naturally see them return. Fixes: 9c2aa65000f6 ("ibmvfc: don't call locked done variant for MADs on se= nd failure") Signed-off-by: Tyrel Datwyler --- drivers/scsi/ibmvscsi/ibmvfc-core.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/ibmvscsi/ibmvfc-core.c b/drivers/scsi/ibmvscsi/ib= mvfc-core.c index 623fff503040..080312ff0a93 100644 --- a/drivers/scsi/ibmvscsi/ibmvfc-core.c +++ b/drivers/scsi/ibmvscsi/ibmvfc-core.c @@ -2696,6 +2696,7 @@ static int ibmvfc_cancel_all_mq(struct scsi_device *s= dev, int type) unsigned long flags; int num_hwq, i; int fail =3D 0; + int rc; LIST_HEAD(cancelq); u16 status; =20 @@ -2722,7 +2723,18 @@ static int ibmvfc_cancel_all_mq(struct scsi_device *= sdev, int type) return -ENOMEM; } evt->sync_iu =3D &queues[i].cancel_rsp; - ibmvfc_send_event(evt, vhost, default_timeout); + rc =3D ibmvfc_send_event(evt, vhost, default_timeout); + if (rc) { + spin_unlock(queues[i].q_lock); + spin_unlock_irqrestore(&vhost->host->host_lock, flags); + sdev_printk(KERN_ERR, sdev, "Failed to send cancel event. rc=3D%d\n", = rc); + list_for_each_entry_safe(evt, temp, &cancelq, cancel) { + wait_for_completion(&evt->comp); + list_del(&evt->cancel); + ibmvfc_free_event(evt); + } + return 0; + } list_add_tail(&evt->cancel, &cancelq); } =20 --=20 2.55.0 From nobody Fri Sep 25 04:07:26 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3C89F38E8CA; Sat, 19 Sep 2026 01:33:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789781611; cv=none; b=Ubv0PX1nvt4d41MQQGVYIyLtCNNymDq3CX5mfwcjucF8MBFkzikIp6o2EhwcWfDuKZ5M+0DLULNx9Oo7CirubpZd3qCpkbLKfrDit/zTlkoUUJn6GIpgLPD+b+oVMsJlhFlItNhZU7Fjit3tWM5ERF1SqcPWwUOmtfz+NNyGI3A= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789781611; c=relaxed/simple; bh=b+g6uPRILIUdLbMLvnEJ/8ndpNXcfA8TBlgzLc2sUqo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=kLHUGGqXJczOG41LGi4Tpc60NBwV7UPo2X3Xya0UmbVfo5z2VnetT6fHnd95Aar/hl/3ivjVAJwO02pLsec8hS9pyk+4C7FQkDRjRmKmjR75Y6ecUcxEpL4WhT4BxoHmJLx9DgZJNiuD2YlO6boALa/0L5RIN/4b86khyPOEbto= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=VClFZRnn; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="VClFZRnn" Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68J1Vtvx1676601; Sat, 19 Sep 2026 01:33:21 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=VTEB1W/56/OQ00pSx 2m5TN3gBudtFEjM/SFMfZL+Hu8=; b=VClFZRnnPqNo89hGGYsKPsnPBbCTgDFa2 4DpeE25xYZBwEiRAD3ca+pOkfiNF7wPneC9QQUjwAErsoQDu4mDmpAlEQB9aGf97 ZjzIbldlJhVAkrha+BoUMLjPNB7Rjynhn4mwjLsQIWnJ2ueeH4h4cuglK8nuP5OX 3L2Y7kRgn0rKMM4QP/zWYdZYPRZyOh3EGAS92Hjs+WG7EcBjDwBBDKpjFVFKFUN5 eg0LVbOKD+nbHMBOYXouq42vzAJztAWMTHi+/y0xrp/sLvA5IABYziB2NPiSDvf3 b0nN/okCG1qA9x+z6v6MRfFbltHVKp87e+UmoUIFXxzblbRQ4E7rg== Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gsgtd803s-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Sat, 19 Sep 2026 01:33:21 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 68J1SRvT1608270; Sat, 19 Sep 2026 01:33:21 GMT Received: from smtprelay04.dal12v.mail.ibm.com ([172.16.1.6]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4gsgrx00aa-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 19 Sep 2026 01:33:21 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (smtpav02.dal12v.mail.ibm.com [10.241.53.101]) by smtprelay04.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 68J1XKa748169226 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 19 Sep 2026 01:33:20 GMT Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 120E858051; Sat, 19 Sep 2026 01:33:20 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 681D25805C; Sat, 19 Sep 2026 01:33:19 +0000 (GMT) Received: from li-4c4c4544-0054-3910-8039-c3c04f423534.ibm.com.com (unknown [9.61.101.145]) by smtpav02.dal12v.mail.ibm.com (Postfix) with ESMTP; Sat, 19 Sep 2026 01:33:19 +0000 (GMT) From: Tyrel Datwyler To: james.bottomley@hansenpartnership.com, martin.petersen@oracle.com Cc: linux-scsi@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, brking@linux.ibm.com, davemarq@linux.ibm.com, Tyrel Datwyler Subject: [PATCH v2 12/20] scsi: ibmvfc: fix data race on tgt->nvme_remote_port Date: Fri, 18 Sep 2026 18:32:58 -0700 Message-ID: <20260919013306.2948028-13-tyreld@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260919013306.2948028-1-tyreld@linux.ibm.com> References: <20260919013306.2948028-1-tyreld@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTE5MDAxOCBTYWx0ZWRfX6HBkGL3HP2yj xNEM8aWs9b71NPeNwAHTM/FGTIl7jK27CvcDZEubDTA1CpIqBQTgb/pRRg+ynW9f+5Mi0pizGIL 10SKOBmCq4MUWKeuwAyQyZThEd/pvxMBXhAS7/Ve3WvDNH/ZE+UjTseLtqgXGMnd7nqgL8JX3rr RYHfH9q5PeLE7uyiAGWoyCyiFGfGRj1P8hhvxkrSm/C3NwjWuGr4UkiF0IbsCK00EaSZfG0arpS CXpk9SbwtcXPLk0s7CyKocHhCoelni56pXVmKiOiTUaEg63IYeCZ28zya/7fiVM8FdmtQEiyaMn rF31q9yQsT+xLyNmy7UOFoXp62RStjzATQWt+cLaXaRimraEMWRYHtsn+2csOfB8E6+vWWrPRYu 6oNZtxZu+l6pHNIpyxsFcDKOOFT4HUUg9PB3c4HAyay32iXzWxhm5b5Y0ThacFGxdKHJgsOR8OB U/iaztevrT3UQU0r24w== X-Proofpoint-GUID: fIN0yPIIkSjo5dFcax-3hn4rAc0Cu9wf X-Proofpoint-ORIG-GUID: fIN0yPIIkSjo5dFcax-3hn4rAc0Cu9wf X-Authority-Analysis: v=2.4 cv=Q49HcI2a c=1 sm=1 tr=0 ts=6aade661 cx=c_pps a=5BHTudwdYE3Te8bg5FgnPg==:117 a=5BHTudwdYE3Te8bg5FgnPg==:17 a=VdqzKS8jKosA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=VnNF1IyMAAAA:8 a=J1oym3C9a2iPP8IqlnUA:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwOTE5MDAxOCBTYWx0ZWRfX1uSyWWF+r9oG 4fKYgcg5Q7fceF38D6rDojzd6mOneHJlnL/vQt+5ehlm+7i/Yr4J8X98K38f6soXCOThgBPcndp RkhVMavVYklX5G+k/qqmM57sqLOuSj4= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-18_07,2026-09-16_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 bulkscore=0 suspectscore=0 spamscore=0 impostorscore=0 phishscore=0 malwarescore=0 clxscore=1015 adultscore=0 lowpriorityscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609190018 Content-Type: text/plain; charset="utf-8" tgt->nvme_remote_port is written in two places without holding host_lock: 1. ibmvfc_nvme_register_remoteport() calls nvme_fc_register_remoteport() and stores the result directly into tgt->nvme_remote_port with no lock held, racing against locked readers in ibmvfc_tgt_add_nvme_rport() and ibmvfc_do_work(). 2. The ibmvfc_nvme_remoteport_delete() callback writes tgt->nvme_remote_port =3D NULL from the NVMe core's thread context with no lock held, again racing against every locked reader of the field. All readers of tgt->nvme_remote_port acquire host_lock before reading the field, so both writers must do the same. For ibmvfc_nvme_register_remoteport(): nvme_fc_register_remoteport() may sleep so it must be called before acquiring the spinlock. Use a local pointer to capture the result, then take host_lock and store the pointer into tgt->nvme_remote_port and set ->private under the lock. For ibmvfc_nvme_remoteport_delete(): acquire host_lock around the tgt->nvme_remote_port =3D NULL store. The callback is always invoked after ibmvfc_nvme_unregister_remoteport() drops host_lock before waiting for completion, so taking the lock here is safe. Fixes: 696d1cc2aaa2 ("scsi: ibmvfc: process NVMe/FC rports in work thread") Signed-off-by: Tyrel Datwyler --- drivers/scsi/ibmvscsi/ibmvfc-nvme.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/drivers/scsi/ibmvscsi/ibmvfc-nvme.c b/drivers/scsi/ibmvscsi/ib= mvfc-nvme.c index 58e3e50d0c5c..a6fc9e8a35f6 100644 --- a/drivers/scsi/ibmvscsi/ibmvfc-nvme.c +++ b/drivers/scsi/ibmvscsi/ibmvfc-nvme.c @@ -26,8 +26,11 @@ static void ibmvfc_nvme_localport_delete(struct nvme_fc_= local_port *lport) static void ibmvfc_nvme_remoteport_delete(struct nvme_fc_remote_port *rpor= t) { struct ibmvfc_target *tgt =3D rport->private; + unsigned long flags; =20 + spin_lock_irqsave(&tgt->vhost->host->host_lock, flags); tgt->nvme_remote_port =3D NULL; + spin_unlock_irqrestore(&tgt->vhost->host->host_lock, flags); complete(&tgt->nvme_delete_done); } =20 @@ -473,7 +476,9 @@ static struct nvme_fc_port_template ibmvfc_nvme_fc_tran= sport =3D { int ibmvfc_nvme_register_remoteport(struct ibmvfc_target *tgt) { struct ibmvfc_host *vhost =3D tgt->vhost; + struct nvme_fc_remote_port *rport; struct nvme_fc_port_info pinfo; + unsigned long flags; int rc; =20 if (!IS_ENABLED(CONFIG_NVME_FC)) @@ -490,14 +495,16 @@ int ibmvfc_nvme_register_remoteport(struct ibmvfc_tar= get *tgt) pinfo.port_id =3D tgt->ids.port_id; pinfo.port_role =3D FC_PORT_ROLE_NVME_TARGET; =20 - rc =3D nvme_fc_register_remoteport(vhost->nvme_local_port, &pinfo, - &tgt->nvme_remote_port); + rc =3D nvme_fc_register_remoteport(vhost->nvme_local_port, &pinfo, &rport= ); =20 + spin_lock_irqsave(&vhost->host->host_lock, flags); if (!rc) { ibmvfc_log(vhost, 2, "register_remoteport: traddr=3Dnn-0x%llx:pn-0x%llx = PortID:%x\n", pinfo.node_name, pinfo.port_name, pinfo.port_id); - tgt->nvme_remote_port->private =3D tgt; + rport->private =3D tgt; + tgt->nvme_remote_port =3D rport; } + spin_unlock_irqrestore(&vhost->host->host_lock, flags); =20 return rc; } --=20 2.55.0 From nobody Fri Sep 25 04:07:26 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A5D2A3D6CD7; Sat, 19 Sep 2026 01:33:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789781611; cv=none; b=heIyey0k/6UpRp9wEulD4ALP26gWgRReXtVdafv1OwdczuRbOXSyca+lDYlcIC+DshSiKuocmIdxd2znlmFGGDbyyZFrXQQPnR5R9MChmNm11K3G65tVYA90dfh3O9zRzGcRzmSWjQ+j1AXngtPNLpcwz7LarUzWKvLkMe8LRqU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789781611; c=relaxed/simple; bh=3N0BBBAIWWwzinPxlFGHJkd00N24takfsezsphafKWo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Lk+iBlXvr2ursaebQFse2XCDoXHjq6M4OWbf4YF8czofiPT8suNeJ7RGd6n1qimUdVL3Kec2q5S8YdornGZOfdBgPK/0DkZQtIb/z1tVHE6PGN9pOFrvOAW+sdBIMPQP10YCuRpSt/oA+Va0KL89kShtaUON+yFfn+KeWQlijVU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=dRY8rmGo; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="dRY8rmGo" Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68J01hQZ2706787; Sat, 19 Sep 2026 01:33:23 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=llwZb5OCLq0KkdUtj amKkQk9o94eDlYi1wOUetAKnc4=; b=dRY8rmGoag93DyBXrltROeZ9WxFTW7EiZ iK0xSlcePl9N4lCn+nKwo3Onw61JLRhCHIKjJklTUQcpSfAvbGcPRYzHDxISJ/ez wKZdxWZ3PVtmivIJXYTNNdGxmF358K9gL9mIbPbzLYvcbOnAwMt0M99oZU6lawJg ZcdSer4MVcxxB2/GZwsj8Daabq4JCSANbQNIqq2G49Qd+NPhvhbIYs5nNo1Cbmoz TZ/ca5Rba+6z1oWvghwYXo+1CH9Qw7Ht2oMDud9swilByWPsrQV1YnFOBzYcDGco 5iqATcyixYBu4H/ZAH1nYZwnRjj/H4eMPmTvG5R6k6cZUMAqOU/nQ== Received: from ppma23.wdc07v.mail.ibm.com (5d.69.3da9.ip4.static.sl-reverse.com [169.61.105.93]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gmxcvj9mk-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Sat, 19 Sep 2026 01:33:22 +0000 (GMT) Received: from pps.filterd (ppma23.wdc07v.mail.ibm.com [127.0.0.1]) by ppma23.wdc07v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 68J1TIsR1629848; Sat, 19 Sep 2026 01:33:22 GMT Received: from smtprelay04.dal12v.mail.ibm.com ([172.16.1.6]) by ppma23.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4gsgsar08k-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 19 Sep 2026 01:33:22 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (smtpav02.dal12v.mail.ibm.com [10.241.53.101]) by smtprelay04.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 68J1XKjA48169230 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 19 Sep 2026 01:33:20 GMT Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id D024D5805E; Sat, 19 Sep 2026 01:33:20 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 2F7495805A; Sat, 19 Sep 2026 01:33:20 +0000 (GMT) Received: from li-4c4c4544-0054-3910-8039-c3c04f423534.ibm.com.com (unknown [9.61.101.145]) by smtpav02.dal12v.mail.ibm.com (Postfix) with ESMTP; Sat, 19 Sep 2026 01:33:20 +0000 (GMT) From: Tyrel Datwyler To: james.bottomley@hansenpartnership.com, martin.petersen@oracle.com Cc: linux-scsi@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, brking@linux.ibm.com, davemarq@linux.ibm.com, Tyrel Datwyler Subject: [PATCH v2 13/20] scsi: ibmvfc: make NVMe FCP abort callback asynchronous Date: Fri, 18 Sep 2026 18:32:59 -0700 Message-ID: <20260919013306.2948028-14-tyreld@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260919013306.2948028-1-tyreld@linux.ibm.com> References: <20260919013306.2948028-1-tyreld@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Info: AW1haW4tMjYwOTE5MDAxOCBTYWx0ZWRfX8DDUcCCEOpOO Vr6ZuIvr+9668zP4GcF/PW+Ok2uR8loARiQdjdduGsp1omIvz/SWVUzZCzjqkIulo860clV6pZK gPcbxkCz7uEmAZnB7K9DzALd4aAeCN4= X-Proofpoint-ORIG-GUID: zLVPODVZ0ZNYkMTxzlathI0oPpVuqlWY X-Proofpoint-GUID: zLVPODVZ0ZNYkMTxzlathI0oPpVuqlWY X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTE5MDAxOCBTYWx0ZWRfX3+lTZBbKi7k9 azOELxsba0aka58qd/av7+5fUUe+lWNjhP2Ug/Vt5i2Zu8K+Qndb0VHZY/J8EfDRs12jXb6x0b6 AGjQPInFCHWtz10fEO+sVDvKtOx0P07F5RRa/FZ7JjTiZgH6RxoGaiWf85bG0+vXliuud1xCFIc BTnkqY5bmqwvfalXb72E/i5HMzr8y4LnQEBxYwx/W4KFKFoTFE9weLM0sSdeap9PlZUYSiYT9mk D7bnv6ccCuWJVY1RCjnnsboEm+ZktOKk8irL6OxlMt0VapNu77liK4cC56wU/DFLZGeF1R5TzEj K4gfl5lMHlRZPxig+epUvSccVcWiC2DnUGJN4fjdauqzpC6y9UQFjdZU6O/GBfQQmPdPgjKnT/l YvO2EY/ec/9uDZ9Jue3I0ACInHiDnvgkh2eN8USVo508KMccf/OI1L/sWbn8fKOFGGvvF9isGR5 EQSNL077indkMqOksRA== X-Authority-Analysis: v=2.4 cv=F+7C5ahN c=1 sm=1 tr=0 ts=6aade662 cx=c_pps a=3Bg1Hr4SwmMryq2xdFQyZA==:117 a=3Bg1Hr4SwmMryq2xdFQyZA==:17 a=VdqzKS8jKosA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=RzCfie-kr_QcCd8fBx8p:22 a=VnNF1IyMAAAA:8 a=bHZ0--RjxAHeecJfWq4A:9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-18_07,2026-09-16_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 suspectscore=0 phishscore=0 clxscore=1015 malwarescore=0 lowpriorityscore=0 bulkscore=0 spamscore=0 impostorscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609190018 Content-Type: text/plain; charset="utf-8" The nvme_fc_port_template fcp_abort callback is called by the NVMe-FC transport from the block layer timeout workqueue. The current implementation submits a cancel MAD and then blocks on wait_for_completion() until the VIOS response arrives. This stalls the timeout workqueue for the full MAD round-trip, preventing any other I/O timeout from being processed in the meantime. The nvme-fc-driver.h API contract is explicit: the LLDD must initiate the abort and return immediately; the ABTS does not need to be complete on return. The transport waits for the original exchange to complete independently via fcp_req->done(). Replace the synchronous ibmvfc_sync_nvme_completion callback with a dedicated ibmvfc_nvme_fcp_abort_done() that runs asynchronously when the cancel MAD response arrives. The new callback logs any non-zero MAD status, drops the target kref, and frees the event. ibmvfc_send_event() guarantees the done callback is invoked on both success and failure paths, so event ownership is fully transferred and ibmvfc_nvme_fcp_abort() returns immediately after ibmvfc_send_event(). Drop the now-unnecessary init_completion() from ibmvfc_init_fcp_abort() and the sync_iu / wait_for_completion / second lock-cycle from the abort function itself. Fixes: 4e70b8795ee3 ("scsi: ibmvfc: implement nvme-fc FCP abort callback") Signed-off-by: Tyrel Datwyler --- drivers/scsi/ibmvscsi/ibmvfc-nvme.c | 34 ++++++++++++----------------- 1 file changed, 14 insertions(+), 20 deletions(-) diff --git a/drivers/scsi/ibmvscsi/ibmvfc-nvme.c b/drivers/scsi/ibmvscsi/ib= mvfc-nvme.c index a6fc9e8a35f6..d23e5f31f8b5 100644 --- a/drivers/scsi/ibmvscsi/ibmvfc-nvme.c +++ b/drivers/scsi/ibmvscsi/ibmvfc-nvme.c @@ -400,8 +400,18 @@ static void ibmvfc_init_fcp_abort(struct ibmvfc_event = *evt, tmf->target_wwpn =3D cpu_to_be64(tgt->wwpn); tmf->assoc_id =3D cpu_to_be64(tgt->assoc_id); tmf->task_tag =3D cpu_to_be64((u64)abt_evt); +} =20 - init_completion(&evt->comp); +static void ibmvfc_nvme_fcp_abort_done(struct ibmvfc_event *evt) +{ + u16 status =3D be16_to_cpu(evt->xfer_iu->mad_common.status); + + if (status) + ibmvfc_dbg(evt->vhost, "fcp_abort: cancel MAD failed with rc=3D%x\n", + status); + + kref_put(&evt->tgt->kref, ibmvfc_release_tgt); + ibmvfc_free_event(evt); } =20 static void ibmvfc_nvme_fcp_abort(struct nvme_fc_local_port *lport, @@ -413,9 +423,7 @@ static void ibmvfc_nvme_fcp_abort(struct nvme_fc_local_= port *lport, struct ibmvfc_target *tgt =3D rport->private; struct ibmvfc_event *evt, *abt_evt =3D abort_req->private; struct ibmvfc_queue *queue; - union ibmvfc_iu rsp; unsigned long flags; - u16 status =3D 0; =20 if (!abt_evt) return; @@ -430,27 +438,13 @@ static void ibmvfc_nvme_fcp_abort(struct nvme_fc_loca= l_port *lport, =20 spin_lock_irqsave(queue->q_lock, flags); kref_get(&tgt->kref); - ibmvfc_init_event(evt, ibmvfc_sync_nvme_completion, IBMVFC_MAD_FORMAT); + ibmvfc_init_event(evt, ibmvfc_nvme_fcp_abort_done, IBMVFC_MAD_FORMAT); ibmvfc_init_fcp_abort(evt, abort_req); - evt->sync_iu =3D &rsp; + evt->tgt =3D tgt; =20 if (ibmvfc_send_event(evt, vhost, default_timeout)) - goto out; - - spin_unlock_irqrestore(queue->q_lock, flags); - - wait_for_completion(&evt->comp); - status =3D be16_to_cpu(rsp.mad_common.status); - - spin_lock_irqsave(queue->q_lock, flags); - ibmvfc_free_event(evt); -out: + kref_put(&tgt->kref, ibmvfc_release_tgt); spin_unlock_irqrestore(queue->q_lock, flags); - - if (status) - ibmvfc_dbg(vhost, "fcp_abort: cancel failed with rc=3D%x\n", status); - - kref_put(&tgt->kref, ibmvfc_release_tgt); } =20 static struct nvme_fc_port_template ibmvfc_nvme_fc_transport =3D { --=20 2.55.0 From nobody Fri Sep 25 04:07:26 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2B8B0394496; Sat, 19 Sep 2026 01:33:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789781613; cv=none; b=U29kSSU9LYT1C61SvYzjN5rVc1nF2h7D9Uus2bmSSKkITqZEsxqJCT57wNwSkmn9HNRGiXXv2hcxh21A6Qkv7tVAv4lC6DcGnGRjA8SiC1KfSSqrq68++go5tarBDCl1GeAA2GsFstRXq3F7PXeeyFfDQ8NM36PNn+/iUYScwYY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789781613; c=relaxed/simple; bh=iwOmATHz6ecG7y6QB9H5IKmbp1v4HCBU86o018GqdGc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=r1M+zpjgmMAdY1iArJUmQNJevUSRvrGn4TBLgQTCpUYRNKXWiwmV6KhnKmYc5TC2nhyMZ6U5fxSCIAEaIKwlxGIAS5L+As6HeSC2KYmsZrUxS80LHCrIR4zg++AXBuvnVGMiddsThnBPaJtfKzwd6BBiCbj/t8Q1k4hsG1kuauc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=EcACn6EK; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="EcACn6EK" Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68J01otQ2706961; Sat, 19 Sep 2026 01:33:23 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=fgHc9VzWY7mw63AsN Par+mYGs4tBOAd2KXAXORTkIt0=; b=EcACn6EK6A8ezQP3BMqEhXCYJX5nYctNq 07oa+Sy7Oi1Fm3pypFe71EVMke5rlU78QlLjK+kQZi4Cq48yp6j3TKc6ODziF0A7 5TDM9H5G8MS4dZP4XG8sAHH067Y8Q+v4n0qOO92HPWovp8di64/QCdyd+7tglh5K r3ihAvrro1+QCM4eJc2I8nqBiNsUluXiCs8mhWhaXW/S4KtZ13wmkKDdHkBfkCMT i9RdZCl2oJhxtowsxzN73n/CWKZRPvlDn4C/0H1tBtBbxh6l+e4qTJtKnicCp2cw 9dMeWJgOugpEqoSHqTh0KUT1d6qsrU+Oi1HlYfsl0ksTPvr5XPIzw== Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gmxcvj9mn-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Sat, 19 Sep 2026 01:33:23 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 68J1QdYb1584450; Sat, 19 Sep 2026 01:33:23 GMT Received: from smtprelay05.wdc07v.mail.ibm.com ([172.16.1.72]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4gsgr2r0ey-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 19 Sep 2026 01:33:23 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (smtpav02.dal12v.mail.ibm.com [10.241.53.101]) by smtprelay05.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 68J1XLXn31720138 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 19 Sep 2026 01:33:22 GMT Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 986E158051; Sat, 19 Sep 2026 01:33:21 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id F044A5805C; Sat, 19 Sep 2026 01:33:20 +0000 (GMT) Received: from li-4c4c4544-0054-3910-8039-c3c04f423534.ibm.com.com (unknown [9.61.101.145]) by smtpav02.dal12v.mail.ibm.com (Postfix) with ESMTP; Sat, 19 Sep 2026 01:33:20 +0000 (GMT) From: Tyrel Datwyler To: james.bottomley@hansenpartnership.com, martin.petersen@oracle.com Cc: linux-scsi@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, brking@linux.ibm.com, davemarq@linux.ibm.com, Tyrel Datwyler Subject: [PATCH v2 14/20] scsi: ibmvfc: fix UAF and stall in NVMe LS abort callback Date: Fri, 18 Sep 2026 18:33:00 -0700 Message-ID: <20260919013306.2948028-15-tyreld@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260919013306.2948028-1-tyreld@linux.ibm.com> References: <20260919013306.2948028-1-tyreld@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Info: AW1haW4tMjYwOTE5MDAxOCBTYWx0ZWRfX0Nn8DJ1qVtxX uSR2NJ9+Sdf9yr1ErXOaEJ5U0rqsKSmbSQ2+OT85uSGoF1IGQWs4JEXOVbmmlztu83WqkO4woDi eqx/Dn/OzX3FOdB/9TpyUw3n9TsGjmM= X-Proofpoint-ORIG-GUID: f7VTWwovgNZgqxy_iXGEOIKrxyTWpP1A X-Proofpoint-GUID: f7VTWwovgNZgqxy_iXGEOIKrxyTWpP1A X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTE5MDAxOCBTYWx0ZWRfX5sQJGXTKXIex a5/0GsVNV4Uo3vYHdA8TF3RQxjnxUeaLC/fMDCpJPIYNX/7jdHLUcUeOb5RqbtApOcBmm27xQ0F 306JNkucecyYG3aF2EwQS65D8XOUp8AKDFeU6DRYZpjiVC6iRlwICs+3HikLWU1YeGHEyYVQ9cf VmY31wlRdoVUXMdiDt3e+tcrLcTJo8TXiq8aOckbjbw+rbRSOLLeMNYFdZwLgUfPgiud1gyQ5XB fv7RUdURGuLxulML096+VdW+sKP/tbvWvk/qvkOeJv0m/+BuR49YVU0cndmspeU5Bh/YkBVRgM1 U0NIpXHV75OkgmFRSJnZRxljocLxsUBzQPZrbn2VciJhYY3etslPEs4aDLxVpbyMT6QkrDrJlUz lPSINyPcL2WzfsEmw484/iqe8NVDcMj2lWdZEbG33cKrmD0VdgK9gSHAYwK6o9Coo9yOcVfFYWs SFYDjkzMvveNa4jHHpA== X-Authority-Analysis: v=2.4 cv=F+7C5ahN c=1 sm=1 tr=0 ts=6aade663 cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=VdqzKS8jKosA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=RzCfie-kr_QcCd8fBx8p:22 a=VnNF1IyMAAAA:8 a=bf3VTdwimHnaYT9JOUcA:9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-18_07,2026-09-16_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 suspectscore=0 phishscore=0 clxscore=1015 malwarescore=0 lowpriorityscore=0 bulkscore=0 spamscore=0 impostorscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609190018 Content-Type: text/plain; charset="utf-8" Two problems in ibmvfc_nvme_ls_abort(): 1. Use-after-free / stale pointer dereference. ibmvfc_init_ls_abort() reads abt_evt =3D ls_abort->private and immediately dereferences abt_evt->tgt. ibmvfc_ls_req_done() calls ibmvfc_free_event() under host_lock, which returns the event slot to the pool. If the LS completes naturally just before ls_abort is called, abt_evt points to a freed (and potentially reused) event, making the dereference a UAF. Fix by taking host_lock before reading ls_abort->private and checking evt->free (set to 1 by ibmvfc_free_event() under host_lock) to detect whether the original LS has already completed. If so, there is nothing to cancel and we return early. ibmvfc_get_event() is also moved inside the lock so the validity check and event allocation are atomic with respect to the completion path. 2. Blocking wait on timeout workqueue (same class as the FCP abort fix). The original code called wait_for_completion() from ls_abort, which is invoked by the NVMe-FC transport from a context that must not block. Fix by replacing ibmvfc_sync_nvme_completion with a dedicated async callback ibmvfc_nvme_ls_abort_done() that logs any non-zero MAD status, drops the target kref, and frees the event. ibmvfc_send_event() guarantees the callback fires on both success and failure paths, so ibmvfc_nvme_ls_abort() returns immediately after ibmvfc_send_event(). ibmvfc_sync_nvme_completion is now unused and is removed. ibmvfc_init_ls_abort() is updated to take the validated abt_evt pointer directly instead of deriving it from ls_abort->private. Fixes: 20bec08f0208 ("scsi: ibmvfc: implement nvme-fc LS abort handling cal= lback") Signed-off-by: Tyrel Datwyler --- drivers/scsi/ibmvscsi/ibmvfc-nvme.c | 68 +++++++++++++++-------------- 1 file changed, 36 insertions(+), 32 deletions(-) diff --git a/drivers/scsi/ibmvscsi/ibmvfc-nvme.c b/drivers/scsi/ibmvscsi/ib= mvfc-nvme.c index d23e5f31f8b5..475177cda103 100644 --- a/drivers/scsi/ibmvscsi/ibmvfc-nvme.c +++ b/drivers/scsi/ibmvscsi/ibmvfc-nvme.c @@ -103,6 +103,7 @@ static void ibmvfc_ls_req_done(struct ibmvfc_event *evt) rc =3D -EIO; =20 evt->ls_req->done(evt->ls_req, rc); + evt->ls_req =3D NULL; =20 kref_put(&tgt->kref, ibmvfc_release_tgt); ibmvfc_free_event(evt); @@ -164,21 +165,12 @@ static int ibmvfc_nvme_ls_req(struct nvme_fc_local_po= rt *lport, return 0; } =20 -static void ibmvfc_sync_nvme_completion(struct ibmvfc_event *evt) +static void ibmvfc_init_ls_abort(struct ibmvfc_event *evt, + struct ibmvfc_event *abt_evt) { - /* copy the response back */ - if (evt->sync_iu) - *evt->sync_iu =3D *evt->xfer_iu; - - complete(&evt->comp); -} - -static void ibmvfc_init_ls_abort(struct ibmvfc_event *evt, struct nvmefc_l= s_req *ls_abort) -{ - struct ibmvfc_tmf *tmf; - struct ibmvfc_event *abt_evt =3D ls_abort->private; struct ibmvfc_target *tgt =3D abt_evt->tgt; struct ibmvfc_host *vhost =3D evt->vhost; + struct ibmvfc_tmf *tmf; =20 tmf =3D &evt->iu.tmf; memset(tmf, 0, sizeof(*tmf)); @@ -192,8 +184,18 @@ static void ibmvfc_init_ls_abort(struct ibmvfc_event *= evt, struct nvmefc_ls_req tmf->cancel_key =3D cpu_to_be32((u64)abt_evt); tmf->my_cancel_key =3D cpu_to_be32((u64)evt); tmf->assoc_id =3D cpu_to_be64(tgt->assoc_id); +} + +static void ibmvfc_nvme_ls_abort_done(struct ibmvfc_event *evt) +{ + u16 status =3D be16_to_cpu(evt->xfer_iu->mad_common.status); + + if (status) + ibmvfc_dbg(evt->vhost, "ls_abort: cancel MAD failed with rc=3D%x\n", + status); =20 - init_completion(&evt->comp); + kref_put(&evt->tgt->kref, ibmvfc_release_tgt); + ibmvfc_free_event(evt); } =20 static void ibmvfc_nvme_ls_abort(struct nvme_fc_local_port *lport, @@ -202,34 +204,36 @@ static void ibmvfc_nvme_ls_abort(struct nvme_fc_local= _port *lport, { struct ibmvfc_host *vhost =3D lport->private; struct ibmvfc_target *tgt =3D rport->private; - struct ibmvfc_event *evt; - union ibmvfc_iu rsp; + struct ibmvfc_event *evt, *abt_evt; unsigned long flags; - u16 status =3D IBMVFC_MAD_CRQ_ERROR; + + spin_lock_irqsave(&vhost->host->host_lock, flags); + + /* + * If the original LS has already completed naturally, abt_evt will + * have been freed back to the pool (evt->free set to 1 under + * host_lock by ibmvfc_free_event()). Nothing left to cancel. + */ + abt_evt =3D ls_abort->private; + if (!abt_evt || atomic_read(&abt_evt->free) || abt_evt->ls_req !=3D ls_ab= ort) { + spin_unlock_irqrestore(&vhost->host->host_lock, flags); + return; + } =20 evt =3D ibmvfc_get_event(&vhost->crq); - if (!vhost->logged_in || !evt) + if (!vhost->logged_in || !evt) { + spin_unlock_irqrestore(&vhost->host->host_lock, flags); return; + } =20 - spin_lock_irqsave(&vhost->host->host_lock, flags); kref_get(&tgt->kref); - ibmvfc_init_event(evt, ibmvfc_sync_nvme_completion, IBMVFC_MAD_FORMAT); - ibmvfc_init_ls_abort(evt, ls_abort); - evt->sync_iu =3D &rsp; + ibmvfc_init_event(evt, ibmvfc_nvme_ls_abort_done, IBMVFC_MAD_FORMAT); + ibmvfc_init_ls_abort(evt, abt_evt); + evt->tgt =3D tgt; =20 if (ibmvfc_send_event(evt, vhost, default_timeout)) - goto out; - - spin_unlock_irqrestore(&vhost->host->host_lock, flags); - - wait_for_completion(&evt->comp); - status =3D be16_to_cpu(rsp.mad_common.status); - spin_lock_irqsave(&vhost->host->host_lock, flags); - ibmvfc_free_event(evt); -out: + kref_put(&tgt->kref, ibmvfc_release_tgt); spin_unlock_irqrestore(&vhost->host->host_lock, flags); - ibmvfc_dbg(vhost, "ls_abort: cancel failed with rc=3D%x\n", status); - kref_put(&tgt->kref, ibmvfc_release_tgt); } =20 static void ibmvfc_nvme_done(struct ibmvfc_event *evt) --=20 2.55.0 From nobody Fri Sep 25 04:07:26 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D9AAA3DB30F; Sat, 19 Sep 2026 01:33:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789781612; cv=none; b=CepdXYWFiz1HFNZCwAcBtXbeEIsf5c9quIjtPmS0fzaQLOHTCpGfDeEfxfnsYzVaEC6brZx6qrbXWg2sYvCxb8KZvryf8jb9aHa/JXIP2paKAIOWvmi6dnK2G0/yN/7ATDYsFwvxfr0QcjxmaDNwo0K2GFXxF/jErsOfF3b7fZQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789781612; c=relaxed/simple; bh=jF/c9abIGS2WOxJEiChggo2tJpujLfVQKRcWuay9c80=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=tv7E3OlNwcpLuTCId8erce3K5A+9xTIER56P20CYCGj7L7rFXFULg4/fmPbxze1nV48vEvC98mmdaOFQxWnE+GAkBiF6iS5hIzc18jWmyX14/ySem5C0XHxoDLmEU9ZlXOJ3Icp1bcDTH/aA/npEAm5eTMMuISWzgGy6z3RtkCo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=BjPR+Zfp; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="BjPR+Zfp" Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68J01YgG2662346; Sat, 19 Sep 2026 01:33:25 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=pp1; bh=310Q0A U+M7NgMF0sYKFvE8ZmxNTxAi3GC1xzvNzQwwc=; b=BjPR+ZfpOb3NRSwZ8tfaep 1tC8mEBZM5LIxW9K1DYtFQ6TeOnqpUso+589XixUHBz+MLWe4UNSaI4TickkXrTW PBagZn6dhUjnQdwXLYCUakhi7VvisCde5qBhV7TNpb48Yw+KZyfJs6Vyaoce+jWK KCVf0qrwN85k2lXSKyzvOQWOOBvjx2rU6mQa7rFHFNhjHbKPgxRIrBduQSLWZvQG OTwc9bwm1KwZrWhPLPxli/AzUI9EwOsEJwlJI9QdrhlQqJfp4vmPgae6FITctF0F CK/M+x6iJ6tDZEMzZfM7GZ+t9jz9pBtykqrE7E1LSAfhhnt1mA6jYMbpG4Mf07rg == Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gmx84b0jc-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Sat, 19 Sep 2026 01:33:24 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 68J1SRM71608298; Sat, 19 Sep 2026 01:33:23 GMT Received: from smtprelay06.wdc07v.mail.ibm.com ([172.16.1.73]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4gsgrx00aj-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 19 Sep 2026 01:33:23 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (smtpav02.dal12v.mail.ibm.com [10.241.53.101]) by smtprelay06.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 68J1XMq932244444 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 19 Sep 2026 01:33:22 GMT Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 4A96558051; Sat, 19 Sep 2026 01:33:22 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id B57945805A; Sat, 19 Sep 2026 01:33:21 +0000 (GMT) Received: from li-4c4c4544-0054-3910-8039-c3c04f423534.ibm.com.com (unknown [9.61.101.145]) by smtpav02.dal12v.mail.ibm.com (Postfix) with ESMTP; Sat, 19 Sep 2026 01:33:21 +0000 (GMT) From: Tyrel Datwyler To: james.bottomley@hansenpartnership.com, martin.petersen@oracle.com Cc: linux-scsi@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, brking@linux.ibm.com, davemarq@linux.ibm.com, Tyrel Datwyler Subject: [PATCH v2 15/20] scsi: ibmvfc: unregister NVMe local port on adapter removal Date: Fri, 18 Sep 2026 18:33:01 -0700 Message-ID: <20260919013306.2948028-16-tyreld@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260919013306.2948028-1-tyreld@linux.ibm.com> References: <20260919013306.2948028-1-tyreld@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTE5MDAxOCBTYWx0ZWRfX/FqsA9kZCGV5 yutD1ntOLAzn0KWA+21JUspHF+LIYrq0PSJvuInj5HiKHFw4e4YSEd0XGZc0CFujXb1k9pHRjV8 mEAKpa8c4VmYQlw/tA+JW7kq70bkOiXh3ye4bbD9ljh2W6pINdCF4jCUJTCVYBdmEPPwks3ZyqX eiHSlb4+PgwFF7r4KDl3LXsCDB+MrCI82+vekYEg3qoQRgt0gW7LMU3nFvqZQb9LuccrD9BzyVN W0h77hD5XukvdvKxgQGqKaiArAIuqNw1K0eG2vfmrN/TtLwEV0fyrzO8TEyRD95WSfhPzaUUwmC z7hGqzTnXR3qwicX6+AYs3nH9VVyrODO3ms3InyOtEHJldHt6iVliFXWIndD5WJJ8a+gjzVsHfd bqW2A6SBE8Up5UXBPC23jjkvIx3RKLzgpdGc2/6V7Lt0PdWd8pb+7AYc5EOjoVHxjmfjPCkaCPu DU40xxVjTekK5H0iQBQ== X-Proofpoint-ORIG-GUID: 4PerKHZR_iOQ9sHzWzK6yRKUHRNtvq6a X-Proofpoint-GUID: 4PerKHZR_iOQ9sHzWzK6yRKUHRNtvq6a X-Proofpoint-Spam-Info: AW1haW4tMjYwOTE5MDAxOCBTYWx0ZWRfX+RkkVwc2/Epb pYTeNEvRQig0lBgsZvpHL2GV4OQkjXOUs6zBsGG3KhdPnS02OlHSH5lOwIhy+FLoiTIXEqbXWcd iIRA/bx/rxb5EEH3Avedi1NTHdlGbQQ= X-Authority-Analysis: v=2.4 cv=cY9HPXDM c=1 sm=1 tr=0 ts=6aade664 cx=c_pps a=5BHTudwdYE3Te8bg5FgnPg==:117 a=5BHTudwdYE3Te8bg5FgnPg==:17 a=IkcTkHD0fZMA:10 a=VdqzKS8jKosA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=iQ6ETzBq9ecOQQE5vZCe:22 a=VnNF1IyMAAAA:8 a=ETEOwY9weeunu4j8P0UA:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-18_07,2026-09-16_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 spamscore=0 bulkscore=0 clxscore=1015 suspectscore=0 impostorscore=0 malwarescore=0 phishscore=0 adultscore=0 lowpriorityscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609190018 ibmvfc_remove() tears down the CRQ and frees all host memory but never calls ibmvfc_nvme_unregister(). The NVMe-FC transport therefore retains a live reference to the local port whose private pointer points into the now-freed ibmvfc_host, leading to a use-after-free whenever the transport subsequently touches the port (queue creation, port scanning, etc.). ibmvfc_nvme_unregister() is already called from the NPIV logout and host reset paths during normal operation; driver removal simply missed it. Add the call after ibmvfc_release_crq_queue() =E2=80=94 at which point the = CRQ is torn down so no further completions can arrive =E2=80=94 and before ibmvfc_free_mem(), so host memory is still valid while nvme_fc_unregister_localport() runs and waits for the localport_delete callback to complete. Fixes: 86e495358096 ("scsi: ibmvfc: implement LLDD callbacks for mapping nv= me-fc queues") Signed-off-by: Tyrel Datwyler --- drivers/scsi/ibmvscsi/ibmvfc-core.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/drivers/scsi/ibmvscsi/ibmvfc-core.c b/drivers/scsi/ibmvscsi/ib= mvfc-core.c index 080312ff0a93..e68ed5e79e58 100644 --- a/drivers/scsi/ibmvscsi/ibmvfc-core.c +++ b/drivers/scsi/ibmvscsi/ibmvfc-core.c @@ -6976,6 +6976,7 @@ static int ibmvfc_probe(struct vio_dev *vdev, const s= truct vio_device_id *id) static void ibmvfc_remove(struct vio_dev *vdev) { struct ibmvfc_host *vhost =3D dev_get_drvdata(&vdev->dev); + struct ibmvfc_target *tgt, *tgt_tmp; LIST_HEAD(purge); unsigned long flags; =20 @@ -6992,6 +6993,22 @@ static void ibmvfc_remove(struct vio_dev *vdev) fc_remove_host(vhost->host); scsi_remove_host(vhost->host); =20 + list_for_each_entry_safe(tgt, tgt_tmp, &vhost->nvme_scrqs.targets, queue)= { + if (tgt->nvme_remote_port) + ibmvfc_nvme_unregister_remoteport(tgt); + list_del(&tgt->queue); + timer_delete_sync(&tgt->timer); + kref_put(&tgt->kref, ibmvfc_release_tgt); + } + + list_for_each_entry_safe(tgt, tgt_tmp, &vhost->scsi_scrqs.targets, queue)= { + if (tgt->rport) + fc_remote_port_delete(tgt->rport); + list_del(&tgt->queue); + timer_delete_sync(&tgt->timer); + kref_put(&tgt->kref, ibmvfc_release_tgt); + } + spin_lock_irqsave(&vhost->host->host_lock, flags); ibmvfc_purge_requests(vhost, DID_ERROR); list_splice_init(&vhost->purge, &purge); @@ -7000,6 +7017,8 @@ static void ibmvfc_remove(struct vio_dev *vdev) ibmvfc_release_sub_crqs(vhost); ibmvfc_release_crq_queue(vhost); =20 + ibmvfc_nvme_unregister(vhost); + ibmvfc_free_mem(vhost); spin_lock(&ibmvfc_driver_lock); list_del(&vhost->queue); --=20 2.55.0 From nobody Fri Sep 25 04:07:26 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 68A873D4129; Sat, 19 Sep 2026 01:33:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789781610; cv=none; b=jiQdYZrYDwtUmC7dkiJffm3udwZZ35V16Tqt0hMvJvrW/gfj5rLW97MUCglE2MZpNdz6hNJXty+hS8kYrFl/0D9r/1nTeQs0hg414V4Er53yoxiMisv4YI0dvoIXiRoT5IKcL3oWV6dhxhB8t0qK8ASOykyjq/YhP71fITLDd/Y= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789781610; c=relaxed/simple; bh=I7MPEmdLh5S0FczeQBdUO91A9FPzoJlynBHXiz9a4LE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=JEah+iZaBvLjX+oHhQwkBuouRWs+cXPl1+WAfUZjmajkhYdcMD9YB+J7Yc7BoI3pLQ9nDuHXcb1/oj7U4EjAjFVQeOfPMOalkJMMcgRHgdJrw5aREp8JDf6GPjHDHw/48a88SnPvttRSiVNGyQFoRq2jJGk2eq5ESIAmqz9O/Xw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=knvNFol6; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="knvNFol6" Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68J1VjaC1676537; Sat, 19 Sep 2026 01:33:25 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=QpaebJl3tZG/L721S cz4SlnmolMwITmlKToP1Y8Cl/g=; b=knvNFol6/GaiM3cfax9p/2wRMmk43yPCj m3EKaTDGxkqr4ldcJavikZNp7Egm4k1yvtmuT4t8UkSbPUlt3NM1D2yqQPwrv7rK MElgkU39oU+iZeMgm8bt4dD4/Mg4WTJKDaRNtzmNv7VPvGzB/Lj7dA1QLePMXl1I 0Nm/MK1bxV+pAPvyhVe5LRXAobLrTEqNtSoHxc5qssgooy3QANQRIkgLMNYu8n0e MHRIhLrhhtqOUIO+JSUCqx7Pr+n39RcDlQPjTPHTOjGON7Ji7A4OLvZFGTQCtxdk EZLUxvZEKwRBKDvWEDnMkp0rDiIveN/HceejrAdoNk1XAQ7+kl9jA== Received: from ppma23.wdc07v.mail.ibm.com (5d.69.3da9.ip4.static.sl-reverse.com [169.61.105.93]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gsgtd803u-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Sat, 19 Sep 2026 01:33:25 +0000 (GMT) Received: from pps.filterd (ppma23.wdc07v.mail.ibm.com [127.0.0.1]) by ppma23.wdc07v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 68J1TW5E1630405; Sat, 19 Sep 2026 01:33:24 GMT Received: from smtprelay07.wdc07v.mail.ibm.com ([172.16.1.74]) by ppma23.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4gsgsar08t-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 19 Sep 2026 01:33:24 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (smtpav02.dal12v.mail.ibm.com [10.241.53.101]) by smtprelay07.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 68J1XNRj23200284 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 19 Sep 2026 01:33:23 GMT Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 10AA058051; Sat, 19 Sep 2026 01:33:23 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 687D35805A; Sat, 19 Sep 2026 01:33:22 +0000 (GMT) Received: from li-4c4c4544-0054-3910-8039-c3c04f423534.ibm.com.com (unknown [9.61.101.145]) by smtpav02.dal12v.mail.ibm.com (Postfix) with ESMTP; Sat, 19 Sep 2026 01:33:22 +0000 (GMT) From: Tyrel Datwyler To: james.bottomley@hansenpartnership.com, martin.petersen@oracle.com Cc: linux-scsi@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, brking@linux.ibm.com, davemarq@linux.ibm.com, Tyrel Datwyler Subject: [PATCH v2 16/20] scsi: ibmvfc: fix NVMe local port leak on fabric link bounce Date: Fri, 18 Sep 2026 18:33:02 -0700 Message-ID: <20260919013306.2948028-17-tyreld@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260919013306.2948028-1-tyreld@linux.ibm.com> References: <20260919013306.2948028-1-tyreld@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTE5MDAxOCBTYWx0ZWRfX2Pp/iwHOqAk3 AkUcdmDpx/yOblhVjwgCrpkteRWDqTcttPUcGUXv5Rim7F1PebpPb1hBzzXYY0BMULJpjfGfD+m FlzKoYCu5bEV9u3rpo/6NT5yWrNenoUrmNWgooYzKcvpItic0VRHrF7OlOc8nOYR5k3YY1wTbPw pWmiu877bR+fKqBHPMDes3DRwpIcjNGwaCQA9iDhaYEq3rhYTxSIp7OKLAdlhUQWo/M/peet4SD ErOY4q7Acgs+OyRgeYPgT0NjFX5JyJ4XI6tT4kR+MHUSIj3s8r1JyX3e887SQY+dZ50wq3CgcEa 9KH5Iem4F6kV3Njmkhx38K6Bnf7PDuuEdT6nO54EGKOPtaRWmXV1SloGvdx+TnXYdRvQWaFZ6zm jOcc1FCkeidauP1Ij8w/yuDnHt18d3QEdRWcRwt4hobsNLuFi+8DYwnmGN64b/JJJa8vGxK6+qS eaEBMFc5a8NTP71nang== X-Proofpoint-GUID: v8hJccpHPGFD9hQsO_34xyYYFIFtcDLz X-Proofpoint-ORIG-GUID: v8hJccpHPGFD9hQsO_34xyYYFIFtcDLz X-Authority-Analysis: v=2.4 cv=Q49HcI2a c=1 sm=1 tr=0 ts=6aade665 cx=c_pps a=3Bg1Hr4SwmMryq2xdFQyZA==:117 a=3Bg1Hr4SwmMryq2xdFQyZA==:17 a=VdqzKS8jKosA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=VnNF1IyMAAAA:8 a=uX4RykLYdoWrl-1yWP0A:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwOTE5MDAxOCBTYWx0ZWRfXzDapPuHNM4jk 4GZULHXmzO+Wep7Ha+9ZZFsqvSSiHPxix+XMTYPxVnsNaUfA6hFgFuDAH+UkXk8YBEaJTrrsUTS v/fPEoQjgJbKXbg6HuZKMBi6OEJ7FxE= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-18_07,2026-09-16_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 bulkscore=0 suspectscore=0 spamscore=0 impostorscore=0 phishscore=0 malwarescore=0 clxscore=1015 adultscore=0 lowpriorityscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609190018 Content-Type: text/plain; charset="utf-8" When the fabric link goes down, ibmvfc_link_down() does not call ibmvfc_nvme_unregister(), so vhost->nvme_local_port remains set across the link bounce. When the adapter re-initializes and completes fabric login, ibmvfc_nvme_register() is called again unconditionally. nvme_fc_register_localport() finds the still-live port in the transport's list (FC_OBJSTATE_ONLINE) and returns -EEXIST, writing NULL into *portptr. The original local port is now orphaned in the transport with no way to reach it, while vhost->nvme_local_port is NULL, leaving NVMe functionality permanently broken for the lifetime of the adapter. Fix by unregistering any existing local port at the top of ibmvfc_nvme_register() before attempting to register a new one. ibmvfc_nvme_register() is called from ibmvfc_do_work() with host_lock dropped, so ibmvfc_nvme_unregister()'s wait_for_completion() is safe there. This makes ibmvfc_nvme_register() idempotent across link bounces without requiring changes to the link-down path. Fixes: 3831863f9f56 ("scsi: ibmvfc: register local nvme fc port after fabri= c login") Signed-off-by: Tyrel Datwyler --- drivers/scsi/ibmvscsi/ibmvfc-nvme.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/scsi/ibmvscsi/ibmvfc-nvme.c b/drivers/scsi/ibmvscsi/ib= mvfc-nvme.c index 475177cda103..89ad7680beb4 100644 --- a/drivers/scsi/ibmvscsi/ibmvfc-nvme.c +++ b/drivers/scsi/ibmvscsi/ibmvfc-nvme.c @@ -537,6 +537,10 @@ int ibmvfc_nvme_register(struct ibmvfc_host *vhost) if (!IS_ENABLED(CONFIG_NVME_FC)) return 0; =20 + /* Unregister any stale local port left from a previous link-up */ + if (vhost->nvme_local_port) + ibmvfc_nvme_unregister(vhost); + pinfo.node_name =3D fc_host_node_name(vhost->host); pinfo.port_name =3D fc_host_port_name(vhost->host); pinfo.port_id =3D fc_host_port_id(vhost->host); --=20 2.55.0 From nobody Fri Sep 25 04:07:26 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 815253DEAC6; Sat, 19 Sep 2026 01:33:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789781614; cv=none; b=bTwfGAL5XsrHu1uxXQ2U6JJFvWE2UsI4jEx9Ho4e1XZ02OkHx1pDo0mq8pgnlDeC5ZZ+gg6sdZ4AHbiBNHoRvVqD1KuXFXtmTbh+6gg6T1K7gsAmAjw1+vWEBGin9K2RuxN+Si/MuVxY31oCSrjHUk/FGa3ONM4it+govuH7lw8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789781614; c=relaxed/simple; bh=z03hf1g/MGed8ekQc4L1G2OMt/GvDb21+J9E3kK0TPU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=twj9jsX9NnMywEVZ/89oEiEQcfrF5PIX38cY6a+L0xOb1cujNnhvNT5uGpkFsNfH6JPh6rMKagRM8KKvQIVeNfxP5tMGFl/g/KpFPAmJoomCrqxw3560hWz5bEq0CAVthupt7N3hihXkme0N1owXORuGylh7lKBiAEkm3zUyO7M= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=TlAUPq2v; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="TlAUPq2v" Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68J01TvK801747; Sat, 19 Sep 2026 01:33:26 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=XCp+AIx+BVjjqDwGo ZSl8tZmJ+UwiSozL3ueZE1nGqI=; b=TlAUPq2vkvXuZIqMJAphdfzu6Loev31dJ zB0ZlwPWCdAbnV8VnJZ+X3+1n129azT2cuUl6RUD1H4nqFYdBaL8Q17KqobQwXAn pFicTw3/QvmqzZBhWm1YiOEgO2ItEum51cN3deqZqA4QboNuOh2weqSp5DW+0HoQ 6XJFGs2OsTxhxONX2nSCAVG9NiKRhvYTmqoLCPDrjFoB5O5iSGT6FHUUElyvvW6Z zTJxjh0hpydohr41AOvfVAYRf7c8722v0YNxiv3QKrGZSpEobDVi2c1J0JjF5suR yNci0AgyBrpSdUjU8zaEy56Uczp2kdCnWQ5UvC05l2lMfvsTz7Fqw== Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gmxdqu07w-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Sat, 19 Sep 2026 01:33:26 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 68J1RstO1659870; Sat, 19 Sep 2026 01:33:25 GMT Received: from smtprelay07.wdc07v.mail.ibm.com ([172.16.1.74]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 4gsgrgg0dd-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 19 Sep 2026 01:33:25 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (smtpav02.dal12v.mail.ibm.com [10.241.53.101]) by smtprelay07.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 68J1XNw318350746 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 19 Sep 2026 01:33:24 GMT Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id CFAA85805E; Sat, 19 Sep 2026 01:33:23 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 2EE615805A; Sat, 19 Sep 2026 01:33:23 +0000 (GMT) Received: from li-4c4c4544-0054-3910-8039-c3c04f423534.ibm.com.com (unknown [9.61.101.145]) by smtpav02.dal12v.mail.ibm.com (Postfix) with ESMTP; Sat, 19 Sep 2026 01:33:23 +0000 (GMT) From: Tyrel Datwyler To: james.bottomley@hansenpartnership.com, martin.petersen@oracle.com Cc: linux-scsi@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, brking@linux.ibm.com, davemarq@linux.ibm.com, Tyrel Datwyler Subject: [PATCH v2 17/20] scsi: ibmvfc: fix TOCTOU race in ibmvfc_nvme_create_queue() on adapter removal Date: Fri, 18 Sep 2026 18:33:03 -0700 Message-ID: <20260919013306.2948028-18-tyreld@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260919013306.2948028-1-tyreld@linux.ibm.com> References: <20260919013306.2948028-1-tyreld@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTE5MDAxOCBTYWx0ZWRfXzZnQQG9DzIcY ockY50V1eZmXyW9nujxj1NyTyjWhJistTaZnSxpTlPmeKwgezasqatXtPG8q+KAbIzRO4JNSVz1 WgO8tA43E72DTv05maTDA9QRxsTIP90g4XqxWtysLDAzc3OJM89zhPMXwinLrKzq4d8NKP5k1TF FDV3U+z862s2P28dkgsT2mCbhrWX4LWKZnhJBEuaDoGCW8rJAsw2B0AVJFVCUsIjE8aGiORejsP f68M8Gt6pU8/9uEg6lt8a8xkTJj4KvLA2cElUAQ9jGfm7/X8uxKg+Zem4iukcTr/auQ6J3EnyH/ EhfbBjiI7oCZbWsd2IlnJ4CE5juGIJZDiHBS1ddRNm8upTKpTTW+zMQuwgb8YfKQiXJeK7RJDJD +Mju1zklNFZt4cp/7xryD/7cBFiYRZyq+0t1wk4DT0qeNJ+v7Aub2muqum5uKySc2wb5B1AKG1E Yjz7Tzl8VOmsf7rY3Dw== X-Proofpoint-GUID: x7o3pkMooAMBmDjjJv3a5KC856JhmAdm X-Authority-Analysis: v=2.4 cv=DobDa2/+ c=1 sm=1 tr=0 ts=6aade666 cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=VdqzKS8jKosA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=VnNF1IyMAAAA:8 a=M1I_nbD3KY5Z_so_vh8A:9 X-Proofpoint-ORIG-GUID: x7o3pkMooAMBmDjjJv3a5KC856JhmAdm X-Proofpoint-Spam-Info: AW1haW4tMjYwOTE5MDAxOCBTYWx0ZWRfX03FWc3gzEWZd uLEs34T+iCQBKUFshK6GDVj2A+UCE0HcHG/YeMJjFfbsjoERyEWodkHXPCHhJv53MqMm9zSUzx5 1VS1YhihpfrRuk7gco665bZHkCIHHWQ= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-18_07,2026-09-16_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 malwarescore=0 priorityscore=1501 suspectscore=0 impostorscore=0 spamscore=0 clxscore=1015 adultscore=0 bulkscore=0 lowpriorityscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609190018 Content-Type: text/plain; charset="utf-8" ibmvfc_remove() called ibmvfc_release_sub_crqs() before ibmvfc_nvme_unregister(). ibmvfc_release_sub_crqs() frees the nvme_scrqs.scrqs array and sets active_queues to 0, but the nvme-fc transport is still live at that point and can call back into ibmvfc_nvme_create_queue(). That callback reads active_queues and dereferences scrqs without any lock, so the window between the guard check and the actual use can race with the teardown, leading to: - divide-by-zero in '(qidx - 1) % vhost->nvme_scrqs.active_queues' when active_queues has been zeroed concurrently, and - NULL pointer dereference on 'vhost->nvme_scrqs.scrqs[qhandle->index]' when scrqs has been freed and set to NULL concurrently. ibmvfc_nvme_unregister() already calls nvme_fc_unregister_localport() followed by wait_for_completion(), which blocks until the transport has fully quiesced all queue operations. It just needs to happen before the sub-CRQ memory is released. Move ibmvfc_nvme_unregister() before ibmvfc_release_sub_crqs() in ibmvfc_remove() so the transport is quiesced before the sub-CRQ arrays are freed. The reset path (ibmvfc_reset_crq) is unaffected: it only deregisters sub-CRQs at the hypervisor level and never frees them, so active_queues and scrqs remain valid across a reset. Fixes: 86e495358096 ("scsi: ibmvfc: implement LLDD callbacks for mapping nv= me-fc queues") Signed-off-by: Tyrel Datwyler --- drivers/scsi/ibmvscsi/ibmvfc-core.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/scsi/ibmvscsi/ibmvfc-core.c b/drivers/scsi/ibmvscsi/ib= mvfc-core.c index e68ed5e79e58..701a9ebf2b7f 100644 --- a/drivers/scsi/ibmvscsi/ibmvfc-core.c +++ b/drivers/scsi/ibmvscsi/ibmvfc-core.c @@ -7014,11 +7014,10 @@ static void ibmvfc_remove(struct vio_dev *vdev) list_splice_init(&vhost->purge, &purge); spin_unlock_irqrestore(&vhost->host->host_lock, flags); ibmvfc_complete_purge(&purge); + ibmvfc_nvme_unregister(vhost); ibmvfc_release_sub_crqs(vhost); ibmvfc_release_crq_queue(vhost); =20 - ibmvfc_nvme_unregister(vhost); - ibmvfc_free_mem(vhost); spin_lock(&ibmvfc_driver_lock); list_del(&vhost->queue); --=20 2.55.0 From nobody Fri Sep 25 04:07:26 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DF3953DF008; Sat, 19 Sep 2026 01:33:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789781614; cv=none; b=khh1PWAeMeaTD0nGert5kIDh6Gji2SEALTrNKTrQ3/qSj3NocfxWVduhDSfcdKqYPKSUKFmlPDwCz+6gVUVLxAXzrjmBhs2q3TXv+RwCxwo/R8fiaLdRr+DVbOCIP6ZWk/8UJw18wHj1Fx73oHWa//NBUO9mtVW9xTjyK0hzE0s= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789781614; c=relaxed/simple; bh=gC5CtJvCE/UeLyLYW3gJmGIK4MsYGFvv3WeROwLAxBM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=s6u7NE9/hTbY2qx7Rvsy4/gNvgujFypYrkx2+saOj+yQnpvweplcSl8sCCJ1q9g9/+H1VubL02xTgalNSNBYzyJt5bppomFBt9kBk1QA6E/rBkIs6OPoCrK/ajhHmdGjCiiKaTtf5xl1GJ5XvgcHUth375TuiBy0Zle8ASaRJ0E= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=o52m33fU; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="o52m33fU" Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68J01WWx801775; Sat, 19 Sep 2026 01:33:27 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=pp1; bh=HcYrKj QC1tsZ3EaUndU0ikjcJs/juHwwYA7r9AuQGTs=; b=o52m33fUtyAv4g9NmYptNe WoOj5z20+saplxo/96/Dd9T9iGJdrwKH/XoETx2bnhJ/zlnHZLPyHXwwtynkaAvl DRXiYQSPT8jqU51yAkwUIP3JcR5HmYfwUUTU8wm7kl58oYFzAu50ytgOheFfyAmV O+tskBBA7RNJPAnJm+erNtIPODCzQAnnpxbMQcJcWVqAJnYrDUa38jWeKFGmO1ou oKcqvfLZMvM69TZXrGb+QRe3zibjIvNJLQg+D4F/oMBKAt3wdlUm6fDPRXoMRU0y KeGRpbwF8wsFl1v/EgPoOH1YzpES/l3h0rZTjp2YVv/mblZFYa+okx5voHLOwl8g == Received: from ppma23.wdc07v.mail.ibm.com (5d.69.3da9.ip4.static.sl-reverse.com [169.61.105.93]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gmxdqu07x-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Sat, 19 Sep 2026 01:33:26 +0000 (GMT) Received: from pps.filterd (ppma23.wdc07v.mail.ibm.com [127.0.0.1]) by ppma23.wdc07v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 68J1TW5F1630405; Sat, 19 Sep 2026 01:33:25 GMT Received: from smtprelay05.dal12v.mail.ibm.com ([172.16.1.7]) by ppma23.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4gsgsar08v-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 19 Sep 2026 01:33:25 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (smtpav02.dal12v.mail.ibm.com [10.241.53.101]) by smtprelay05.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 68J1XOBI33620714 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 19 Sep 2026 01:33:24 GMT Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 91E8158051; Sat, 19 Sep 2026 01:33:24 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id EB02F5805A; Sat, 19 Sep 2026 01:33:23 +0000 (GMT) Received: from li-4c4c4544-0054-3910-8039-c3c04f423534.ibm.com.com (unknown [9.61.101.145]) by smtpav02.dal12v.mail.ibm.com (Postfix) with ESMTP; Sat, 19 Sep 2026 01:33:23 +0000 (GMT) From: Tyrel Datwyler To: james.bottomley@hansenpartnership.com, martin.petersen@oracle.com Cc: linux-scsi@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, brking@linux.ibm.com, davemarq@linux.ibm.com, Tyrel Datwyler Subject: [PATCH v2 18/20] scsi: ibmvfc: fix NVMe sub-queue registration failure disabling SCSI multiqueue Date: Fri, 18 Sep 2026 18:33:04 -0700 Message-ID: <20260919013306.2948028-19-tyreld@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260919013306.2948028-1-tyreld@linux.ibm.com> References: <20260919013306.2948028-1-tyreld@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTE5MDAxOCBTYWx0ZWRfX5nakQqkm8b2x rT0iJ+9wui29RimkAspRRoOuTscjTKRRwK1OB4L/5jQx0ULyvhQvQMk/uhvsKAmNBFAZcI9a+Uy 5oVMmq1pkCXQ1j6Uja3hJjw0TjZ0mmqQ1+HKrwJdIIF6VKeYKXa+L1m0cMfAyxGDHsgYQmSetJM 3cj/pkx3aweO9KOtBlf5hC1x+57Ajo7XWLzO4hiR0Zf4SDnS+W8oCwSopf3egrP9wdzKQALfMlA H98QQ3SMigAbR9dMZhbVZWEMrf/LmK2eaQmzxUqrfVU0DSR8k6im4ZxWD7z7k0wq9u2BnpgrE4x T3IKbKKWMXD5qa7G9WhH7IwdfdLrylUyanUNRdsZ5hLHObd9DNYtCye+OJ5TW/nNbwtB70m4sez magCXtSYiQI0PpO4JjGvNu5FoI4tOvaTITqDk/JSbhXRcOxej4L9PH/TPVki65KD9SLBTfFoa1P bopr7GNP0pWShPPam9A== X-Proofpoint-GUID: Hp85aObUSyI770F8iJk-7OSdbNmfklGW X-Authority-Analysis: v=2.4 cv=DobDa2/+ c=1 sm=1 tr=0 ts=6aade666 cx=c_pps a=3Bg1Hr4SwmMryq2xdFQyZA==:117 a=3Bg1Hr4SwmMryq2xdFQyZA==:17 a=IkcTkHD0fZMA:10 a=VdqzKS8jKosA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=VnNF1IyMAAAA:8 a=f5D_ObsrWLTxtF3643IA:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 X-Proofpoint-ORIG-GUID: Hp85aObUSyI770F8iJk-7OSdbNmfklGW X-Proofpoint-Spam-Info: AW1haW4tMjYwOTE5MDAxOCBTYWx0ZWRfXyUCxme7mSS+b cFn0+c/0k6O2ZFZvgyBDVUX51hv2TuqPIXY90karkkXjgTb7yazsXq3XUwGNH1aCPMb6fpoY40s wXQqUOrQJAHkD8JHREv/b9nqtZyhlJI= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-18_07,2026-09-16_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 malwarescore=0 priorityscore=1501 suspectscore=0 impostorscore=0 spamscore=0 clxscore=1015 adultscore=0 bulkscore=0 lowpriorityscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609190018 ibmvfc_reg_sub_crqs() clears vhost->do_enquiry unconditionally when any channel registration fails. The function is called for SCSI channels first and then for NVMe channels (in ibmvfc_init_sub_crqs(), ibmvfc_reset_crq(), and ibmvfc_reenable_crq_queue()). If the NVMe channel registration fails, do_enquiry is cleared even though SCSI channels registered successfully, preventing the IBMVFC_CHANNEL_ENQUIRY MAD from being sent and silently disabling multiqueue support for SCSI. ibmvfc_init_sub_crqs() already handles NVMe *allocation* failure correctly =E2=80=94 it only clears nvme_enabled without touching do_enquiry. The same logic needs to apply when NVMe *registration* fails. Fix ibmvfc_reg_sub_crqs() to check channels->protocol in the failure path: clear do_enquiry only for a SCSI channel failure (preserving existing behaviour), and clear nvme_enabled instead for an NVMe channel failure. This covers all three call sites in one place. Fixes: 319f6545a2d4 ("scsi: ibmvfc: alloc/dealloc sub-queues for nvme chann= els") Signed-off-by: Tyrel Datwyler --- drivers/scsi/ibmvscsi/ibmvfc-core.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/ibmvscsi/ibmvfc-core.c b/drivers/scsi/ibmvscsi/ib= mvfc-core.c index 701a9ebf2b7f..914dafd576a0 100644 --- a/drivers/scsi/ibmvscsi/ibmvfc-core.c +++ b/drivers/scsi/ibmvscsi/ibmvfc-core.c @@ -992,6 +992,8 @@ static int ibmvfc_reenable_crq_queue(struct ibmvfc_host= *vhost) vhost->do_scsi_login =3D 0; vhost->do_nvme_login =3D 0; vhost->do_nvme_register =3D 0; + if (vhost->nvme_scrqs.scrqs) + vhost->nvme_enabled =3D 1; spin_unlock(vhost->crq.q_lock); spin_unlock_irqrestore(&vhost->host->host_lock, flags); =20 @@ -1034,6 +1036,8 @@ static int ibmvfc_reset_crq(struct ibmvfc_host *vhost) vhost->do_scsi_login =3D 0; vhost->do_nvme_login =3D 0; vhost->do_nvme_register =3D 0; + if (vhost->nvme_scrqs.scrqs) + vhost->nvme_enabled =3D 1; =20 /* Clean out the queue */ memset(crq->msgs.crq, 0, PAGE_SIZE); @@ -6532,7 +6536,10 @@ static void ibmvfc_reg_sub_crqs(struct ibmvfc_host *= vhost, if (ibmvfc_register_channel(vhost, channels, i)) { for (j =3D i; j > 0; j--) ibmvfc_deregister_channel(vhost, channels, j - 1); - vhost->do_enquiry =3D 0; + if (channels->protocol =3D=3D IBMVFC_PROTO_SCSI) + vhost->do_enquiry =3D 0; + else + vhost->nvme_enabled =3D 0; return; } } --=20 2.55.0 From nobody Fri Sep 25 04:07:26 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1527E3E16A0; Sat, 19 Sep 2026 01:33:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789781615; cv=none; b=S+yFG6pqC7umzBYKXmCTEsahByRdfpRzDF/82QzlqzqRFKxJphwHoNFifXKOLlkc0k/TEbv3XtjazLS+xO78A2pEmP0LLHRmkEk4tzWmJsHB3syC/e/SVsXsSM0jDmlCOSON5caQjIp5vJe7KMabStrKaEbzUNMVcgJ6HaShlDI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789781615; c=relaxed/simple; bh=9n3jw0bc9GOBbZxnNNcZzb6TQF3SJuAl2o09sJ0/0PQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=IvXBW0kCvvpDskr+l/QlRAQHKA9Ogd3+4P7VmAEjFnOJnn/rxK80PPgrP901pUFzzy3zthGMZLteuR5aNYRgY8KsFynKJRP/h6W69Fl3+taFMBt3nG2+3KDsX+aScsLVuuYhq2Pg0KUkExCK06R3sL6TsVqS/YrPzYSyCp0a/G0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=CII3xBLl; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="CII3xBLl" Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68J01Uiv2680644; Sat, 19 Sep 2026 01:33:27 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=phbR+VoCy+l67iNzM nzZ/XlM0J8ZoivbSnF1+CYAYxU=; b=CII3xBLlyQYnDKPjBTPG3bmy0duU/Qez9 JoUBAPnW78QfbEquUxfD/eVKj/mi7DTJERdI3QzzXsh8/yuyqA+XZnYFm90qcNfl L4EQvtWdkOFU3GPh3wrFQN5G5mf2X5x3E7ayK1vUFaevr6OqaT0MwlxZjrYSuGCq Ie7zyZze5QYIaKNeHbOWLey51SriWkdEJmWR/2PWlmZlezI5CcM89A8QzkPTuODS 1PBeSMF9ZIG3pSKHiIZCSq8XvfPAXJh9Zok7jxRTGHG69x3bAtdlm8dMd4jxE9iS xNjEReyjVr6jozNMduCVEeu0QLRpqLAnbwTVQMEVA0eifcKUolHGA== Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gmxf5k1u1-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Sat, 19 Sep 2026 01:33:26 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 68J1PhbC1662563; Sat, 19 Sep 2026 01:33:26 GMT Received: from smtprelay06.dal12v.mail.ibm.com ([172.16.1.8]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4gsgqn00g1-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 19 Sep 2026 01:33:26 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (smtpav02.dal12v.mail.ibm.com [10.241.53.101]) by smtprelay06.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 68J1XPbK33686172 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 19 Sep 2026 01:33:25 GMT Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 5450E58051; Sat, 19 Sep 2026 01:33:25 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id AEE965805A; Sat, 19 Sep 2026 01:33:24 +0000 (GMT) Received: from li-4c4c4544-0054-3910-8039-c3c04f423534.ibm.com.com (unknown [9.61.101.145]) by smtpav02.dal12v.mail.ibm.com (Postfix) with ESMTP; Sat, 19 Sep 2026 01:33:24 +0000 (GMT) From: Tyrel Datwyler To: james.bottomley@hansenpartnership.com, martin.petersen@oracle.com Cc: linux-scsi@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, brking@linux.ibm.com, davemarq@linux.ibm.com, Tyrel Datwyler Subject: [PATCH v2 19/20] scsi: ibmvfc: fix nr_nvme_hw_queues module parameter ignored for NVMe queue sizing Date: Fri, 18 Sep 2026 18:33:05 -0700 Message-ID: <20260919013306.2948028-20-tyreld@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260919013306.2948028-1-tyreld@linux.ibm.com> References: <20260919013306.2948028-1-tyreld@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: DMtZrPxcUgzOq1SiOIwIWvjbMY9RYhoE X-Proofpoint-Spam-Info: AW1haW4tMjYwOTE5MDAxOCBTYWx0ZWRfX0Wsiw+z+D5Sr paOttF/1T2exjygXFibE683sytJ77wji1ihz1pzX4LAb4TutJOdL1J+WoXPZW/kXS32f7as8feg 9cgVfV28P0HnaoDTqp2mOuNlKxsSmOo= X-Authority-Analysis: v=2.4 cv=cvgOAF4i c=1 sm=1 tr=0 ts=6aade667 cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=VdqzKS8jKosA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=U7nrCbtTmkRpXpFmAIza:22 a=VnNF1IyMAAAA:8 a=YHccNbNTKC1xL-9NveAA:9 X-Proofpoint-ORIG-GUID: DMtZrPxcUgzOq1SiOIwIWvjbMY9RYhoE X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTE5MDAxOCBTYWx0ZWRfX2ZBhi0x1BnuG /37qsL9Oo8OpxNPpmnjeb2bvc2dhdDhDNHw2MWlgTIcYPeDIu6HzNvr/BggFm0X7OTMYGi9md43 DW6p3vxZZGZMnIwVgTNFNMccGAH9fJrJaO4Ioo5cOH1g0nHHTd2ygGt0vGoI1oarVeMZPCNZmIp ZzmIluOfL2O+k+CX8kC45qsWxCRwBzobGrcjxHM6kn2J1OFxcNq74biiEJHYFTUtJVIC9UfW9Ug p3ePlVBw8a4crAOhunNIOcm9LdvjWuIxWeqfIXwtGq2PtbCXO9voOsJyLRj59QbvsAHw5SZX9Xa pEeQFT7j+tUfaBd/oQaeqSN3ghe6K/45/MjdfaaXxzO5Qee2iKXp7mvlEY/I4GAWn6YgClc9ZxA 1umTbS23se8Dx/p20l2UAu+adCM0ojDkpFmA0zt8JRZ9WA3DVbX9hrbcnphNYIy3S4hfVqAJVIF ELmCew6fsc1WvV9eQww== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-18_07,2026-09-16_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 lowpriorityscore=0 clxscore=1015 priorityscore=1501 suspectscore=0 bulkscore=0 impostorscore=0 phishscore=0 spamscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609190018 Content-Type: text/plain; charset="utf-8" max_nvme_queues was computed as min(IBMVFC_MAX_NVME_QUEUES, online_cpus), silently ignoring the nr_nvme_hw_queues module parameter. The SCSI path correctly caps shost->nr_hw_queues with nr_scsi_hw_queues, but the NVMe equivalent was never applied, making the 'nvme_host_queues' parameter a no-op. Apply the same pattern as the SCSI side: incorporate nr_nvme_hw_queues into the max_nvme_queues calculation at probe time so that nvme_scrqs.max_queues and nvme_scrqs.desired_queues both respect the administrator-provided limit. Fixes: 018fc3965291 ("scsi: ibmvfc: initialize NVMe channel configuration d= uring driver probe") Signed-off-by: Tyrel Datwyler --- drivers/scsi/ibmvscsi/ibmvfc-core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/ibmvscsi/ibmvfc-core.c b/drivers/scsi/ibmvscsi/ib= mvfc-core.c index 914dafd576a0..ca9a0437fc0c 100644 --- a/drivers/scsi/ibmvscsi/ibmvfc-core.c +++ b/drivers/scsi/ibmvscsi/ibmvfc-core.c @@ -6871,7 +6871,9 @@ static int ibmvfc_probe(struct vio_dev *vdev, const s= truct vio_device_id *id) int rc =3D -ENOMEM; unsigned int online_cpus =3D num_online_cpus(); unsigned int max_scsi_queues =3D min_t(unsigned int, IBMVFC_MAX_SCSI_QUEU= ES, online_cpus); - unsigned int max_nvme_queues =3D min_t(unsigned int, IBMVFC_MAX_NVME_QUEU= ES, online_cpus); + unsigned int max_nvme_queues =3D min_t(unsigned int, + min(IBMVFC_MAX_NVME_QUEUES, nr_nvme_hw_queues), + online_cpus); =20 ENTER; shost =3D scsi_host_alloc(&driver_template, sizeof(*vhost)); --=20 2.55.0 From nobody Fri Sep 25 04:07:26 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E6E9A38D3ED; Sat, 19 Sep 2026 01:33:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789781617; cv=none; b=u8c+R3yymd2SzqTgSxM7enJ7g++A4JGo5+RJg5QBZNmpcLXOq3pTb5RE/ixW5W6nrMJLeQQJwG+z8hYkeR/29+DntwknDTe5L+0AZBNuaRraXPR3RJI8G2R5O0eXrU02lFXWAtnj5A0cR4yhHh+YDgHdofg70WPKJ3MRbkHPfCU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789781617; c=relaxed/simple; bh=ayX4y5VxNuuRHCYZUB1S4MHP2aL2td8NAKz23JDBGIA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=SmqhDVh7WQBUB5H/v4w+3Cl988deouuZU3GC7n0Bf2MaHtcaJMm2WaF0MZm3P2Z1r7Cuf9hY3G725OQvAY2HzURhMBRs4epv5TMDK+JExEYBdIhM9YmtqPZwx9o7IQ+B4gfFi0dheKu0FS6vjAq0kTr/QmaII44yG6ZASf0aMxQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=C83+cY/c; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="C83+cY/c" Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68J01U7N2662258; Sat, 19 Sep 2026 01:33:28 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=UDMf5Wk1qyT/dSPEs Q2r9cDTMThOrVKd03KqreuuP8U=; b=C83+cY/cgU5rD/mbmoUfcB0XyTIJ8TYvC c6fnpKc3d8YeufUufDaKk3zR8xUHNmS2TFfsV1wHGsNZxwx181nv4X025is1QxCj uEkzM1tbrZVjPXK/20SaAUc293QJn7scil9rFJNrICnEBI1SezkduPC2QMt7nLTs o6y98Wy1gtTa5MzOdaI9IRHDMLtBMfm8tVgKAimD4zP+5uPOUOlBBjKqgFre19LC eK9CVvY7WKIQtEgEzgLnnsVGBtiXa5r//RAnw7ydjLXb7Nlcodh4JG8OY6POYzWR YUunY3EIOyfXoQP6Thk+AFLf8GbLcjdj3FaE2Qv9Ch8HAanaLLAsQ== Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gmx84b0jk-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Sat, 19 Sep 2026 01:33:27 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 68J1RaOc1658899; Sat, 19 Sep 2026 01:33:27 GMT Received: from smtprelay07.dal12v.mail.ibm.com ([172.16.1.9]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 4gsgrgg0dm-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 19 Sep 2026 01:33:27 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (smtpav02.dal12v.mail.ibm.com [10.241.53.101]) by smtprelay07.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 68J1XQEL26411582 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 19 Sep 2026 01:33:26 GMT Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 1B82258051; Sat, 19 Sep 2026 01:33:26 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 7219A5805A; Sat, 19 Sep 2026 01:33:25 +0000 (GMT) Received: from li-4c4c4544-0054-3910-8039-c3c04f423534.ibm.com.com (unknown [9.61.101.145]) by smtpav02.dal12v.mail.ibm.com (Postfix) with ESMTP; Sat, 19 Sep 2026 01:33:25 +0000 (GMT) From: Tyrel Datwyler To: james.bottomley@hansenpartnership.com, martin.petersen@oracle.com Cc: linux-scsi@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, brking@linux.ibm.com, davemarq@linux.ibm.com, Tyrel Datwyler Subject: [PATCH v2 20/20] scsi: ibmvfc: fix concurrent SCSI and NVMe discover-targets race dropping targets Date: Fri, 18 Sep 2026 18:33:06 -0700 Message-ID: <20260919013306.2948028-21-tyreld@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260919013306.2948028-1-tyreld@linux.ibm.com> References: <20260919013306.2948028-1-tyreld@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTE5MDAxOCBTYWx0ZWRfX1HjFvpICJyd2 HoCw7zlVzk3uAA4LeNpQe0vc6snYE7n2MjBnr3eoF6kzv9isAy2ZIKnFB8gGoHkapVnZOqe/yup cYTnfnHyX0PWbjFGSJvtZ4NUz48tR3GEdG3ac4z8R9T7Smz7YJU23+iczqvRpFvt3v46VJ6zqAI 06osr5nIH4v18zB8XW+H7Nr7bEObzD4vLSRHQyv/TQxv+QPURKEYn9nzxsNw/LntTaJkzbMTk5v r3DS5cAJvMGtfdlCFThu7F6oNpxD7IkskNfiUEHIwPmkdD4EemKHEPOyEBX45TSUwQXqvItebS8 Xrw7ArPdMyu6djw7fr92h/RZ/MaI9dd5MsmJbI2ZEqxtcZOYdNoZnYdV3WFRT7AUzDR4B0+4Q8e wQ494KGoaWmnPxbjPV+3ucz4kfvUzpN/quPnCaUtXGGQp1nnkwTCqH/MKDzXExGYcvgwzyrtrzk hmSJvC6EElv2RJt1qAA== X-Proofpoint-ORIG-GUID: _3i7vAMg0zk4pxgHNMCPaoXfSiNABME3 X-Proofpoint-GUID: _3i7vAMg0zk4pxgHNMCPaoXfSiNABME3 X-Proofpoint-Spam-Info: AW1haW4tMjYwOTE5MDAxOCBTYWx0ZWRfX2A5G05OEnlL+ 0MhLFaPTrtiNJrKJxu73psZjBBtpyq7PHA2JbUNXAS0k1D7rShZlSUFI38RUDgNIxK4pxhdxP+w cFo59Jzh0Y9yICa2plOPgL/HtX6lLRQ= X-Authority-Analysis: v=2.4 cv=cY9HPXDM c=1 sm=1 tr=0 ts=6aade667 cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=VdqzKS8jKosA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=iQ6ETzBq9ecOQQE5vZCe:22 a=VnNF1IyMAAAA:8 a=TELSalMAAoxOiMB7PF4A:9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-18_07,2026-09-16_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 spamscore=0 bulkscore=0 clxscore=1015 suspectscore=0 impostorscore=0 malwarescore=0 phishscore=0 adultscore=0 lowpriorityscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609190018 Content-Type: text/plain; charset="utf-8" Commit 5e9dd03726ad ("scsi: ibmvfc: send NVMe target discovery MAD") introduced concurrent SCSI and NVMe discover-target MADs. ibmvfc_discover_targets_done() unconditionally set IBMVFC_HOST_ACTION_ALLOC_TGTS on the first completion to arrive. ibmvfc_alloc_targets() ran immediately and read both channels' disc_buf and num_targets fields while the slower protocol's MAD was still in flight. The slower protocol's num_targets remained zero from the previous cycle, silently dropping all targets for that protocol. The second completion attempted to transition to ALLOC_TGTS again but the state machine had already advanced, so the transition was a no-op and ibmvfc_alloc_targets() was never re-run. Fix this by serializing discovery: send the SCSI discover-targets MAD first and wait for its completion before sending the NVMe MAD. ibmvfc_discover_scsi_targets_done() advances the job_step to ibmvfc_discover_nvme_targets() when NVMe is active, or transitions directly to IBMVFC_HOST_ACTION_ALLOC_TGTS when it is not. ibmvfc_discover_nvme_targets_done() then transitions to ALLOC_TGTS after the NVMe buffer is fully written. This guarantees that ibmvfc_alloc_targets() is only called after both discovery buffers are complete with no shared counter and no concurrent MADs in flight. Fixes: 5e9dd03726ad ("scsi: ibmvfc: send NVMe target discovery MAD") Signed-off-by: Tyrel Datwyler --- drivers/scsi/ibmvscsi/ibmvfc-core.c | 115 +++++++++++++++++++--------- 1 file changed, 79 insertions(+), 36 deletions(-) diff --git a/drivers/scsi/ibmvscsi/ibmvfc-core.c b/drivers/scsi/ibmvscsi/ib= mvfc-core.c index ca9a0437fc0c..46d6b94cb96d 100644 --- a/drivers/scsi/ibmvscsi/ibmvfc-core.c +++ b/drivers/scsi/ibmvscsi/ibmvfc-core.c @@ -184,6 +184,7 @@ static void ibmvfc_tgt_send_prli(struct ibmvfc_target *= ); static void ibmvfc_tgt_send_plogi(struct ibmvfc_target *); static void ibmvfc_tgt_query_target(struct ibmvfc_target *); static void ibmvfc_npiv_logout(struct ibmvfc_host *); +static void ibmvfc_discover_nvme_targets(struct ibmvfc_host *); static void ibmvfc_tgt_implicit_logout_and_del(struct ibmvfc_target *); static void ibmvfc_tgt_move_login(struct ibmvfc_target *); =20 @@ -5137,45 +5138,80 @@ static int ibmvfc_alloc_targets(struct ibmvfc_host = *vhost) } =20 /** - * ibmvfc_discover_targets_done - Completion handler for discover targets = MAD + * ibmvfc_discover_scsi_targets_done - Completion handler for SCSI discove= r targets MAD * @evt: ibmvfc event struct * **/ -static void ibmvfc_discover_targets_done(struct ibmvfc_event *evt) +static void ibmvfc_discover_scsi_targets_done(struct ibmvfc_event *evt) { struct ibmvfc_host *vhost =3D evt->vhost; struct ibmvfc_discover_targets *rsp =3D &evt->xfer_iu->discover_targets; - struct ibmvfc_channels *channels; u32 mad_status =3D be16_to_cpu(rsp->common.status); - u32 opcode =3D be32_to_cpu(rsp->common.opcode); int level =3D IBMVFC_DEFAULT_LOG_LEVEL; =20 - if (opcode =3D=3D IBMVFC_DISC_TARGETS) - channels =3D &vhost->scsi_scrqs; - else - channels =3D &vhost->nvme_scrqs; + switch (mad_status) { + case IBMVFC_MAD_SUCCESS: + ibmvfc_dbg(vhost, "Discover SCSI Targets succeeded\n"); + vhost->scsi_scrqs.num_targets =3D min_t(u32, be32_to_cpu(rsp->num_writte= n), + max_targets); + ibmvfc_dbg(vhost, "%d SCSI targets found\n", + vhost->scsi_scrqs.num_targets); + if (ibmvfc_nvme_active(vhost)) { + ibmvfc_set_host_action(vhost, IBMVFC_HOST_ACTION_INIT); + vhost->job_step =3D ibmvfc_discover_nvme_targets; + } else { + ibmvfc_set_host_action(vhost, IBMVFC_HOST_ACTION_ALLOC_TGTS); + } + break; + case IBMVFC_MAD_FAILED: + level +=3D ibmvfc_retry_host_init(vhost); + ibmvfc_log(vhost, level, "Discover SCSI Targets failed: %s (%x:%x)\n", + ibmvfc_get_cmd_error(be16_to_cpu(rsp->status), be16_to_cpu(rsp->erro= r)), + be16_to_cpu(rsp->status), be16_to_cpu(rsp->error)); + break; + case IBMVFC_MAD_DRIVER_FAILED: + break; + default: + dev_err(vhost->dev, "Invalid Discover SCSI Targets response: 0x%x\n", ma= d_status); + ibmvfc_link_down(vhost, IBMVFC_LINK_DEAD); + break; + } + + ibmvfc_free_event(evt); + wake_up(&vhost->work_wait_q); +} + +/** + * ibmvfc_discover_nvme_targets_done - Completion handler for NVMe discove= r targets MAD + * @evt: ibmvfc event struct + * + **/ +static void ibmvfc_discover_nvme_targets_done(struct ibmvfc_event *evt) +{ + struct ibmvfc_host *vhost =3D evt->vhost; + struct ibmvfc_discover_targets *rsp =3D &evt->xfer_iu->discover_targets; + u32 mad_status =3D be16_to_cpu(rsp->common.status); + int level =3D IBMVFC_DEFAULT_LOG_LEVEL; =20 switch (mad_status) { case IBMVFC_MAD_SUCCESS: - ibmvfc_dbg(vhost, "Discover %s Targets succeeded\n", - proto_type[channels->protocol]); - channels->num_targets =3D min_t(u32, be32_to_cpu(rsp->num_written), - max_targets); - ibmvfc_dbg(vhost, "%d %s targets found\n", channels->num_targets, - proto_type[channels->protocol]); + ibmvfc_dbg(vhost, "Discover NVMe Targets succeeded\n"); + vhost->nvme_scrqs.num_targets =3D min_t(u32, be32_to_cpu(rsp->num_writte= n), + max_targets); + ibmvfc_dbg(vhost, "%d NVMe targets found\n", + vhost->nvme_scrqs.num_targets); ibmvfc_set_host_action(vhost, IBMVFC_HOST_ACTION_ALLOC_TGTS); break; case IBMVFC_MAD_FAILED: level +=3D ibmvfc_retry_host_init(vhost); - ibmvfc_log(vhost, level, "Discover %s Targets failed: %s (%x:%x)\n", - proto_type[channels->protocol], + ibmvfc_log(vhost, level, "Discover NVMe Targets failed: %s (%x:%x)\n", ibmvfc_get_cmd_error(be16_to_cpu(rsp->status), be16_to_cpu(rsp->erro= r)), be16_to_cpu(rsp->status), be16_to_cpu(rsp->error)); break; case IBMVFC_MAD_DRIVER_FAILED: break; default: - dev_err(vhost->dev, "Invalid Discover Targets response: 0x%x\n", mad_sta= tus); + dev_err(vhost->dev, "Invalid Discover NVMe Targets response: 0x%x\n", ma= d_status); ibmvfc_link_down(vhost, IBMVFC_LINK_DEAD); break; } @@ -5184,7 +5220,8 @@ static void ibmvfc_discover_targets_done(struct ibmvf= c_event *evt) wake_up(&vhost->work_wait_q); } =20 -static struct ibmvfc_event *ibmvfc_get_disc_event(struct ibmvfc_channels *= channels) +static struct ibmvfc_event *ibmvfc_get_disc_event(struct ibmvfc_channels *= channels, + void (*done)(struct ibmvfc_event *)) { struct ibmvfc_discover_targets *mad; struct ibmvfc_host *vhost =3D ibmvfc_channels_to_vhost(channels); @@ -5193,7 +5230,7 @@ static struct ibmvfc_event *ibmvfc_get_disc_event(str= uct ibmvfc_channels *channe if (!evt) return NULL; =20 - ibmvfc_init_event(evt, ibmvfc_discover_targets_done, IBMVFC_MAD_FORMAT); + ibmvfc_init_event(evt, done, IBMVFC_MAD_FORMAT); mad =3D &evt->iu.discover_targets; memset(mad, 0, sizeof(*mad)); mad->common.version =3D cpu_to_be32(1); @@ -5211,17 +5248,18 @@ static struct ibmvfc_event *ibmvfc_get_disc_event(s= truct ibmvfc_channels *channe } =20 /** - * ibmvfc_discover_targets - Send Discover Targets MAD + * ibmvfc_discover_nvme_targets - Send Discover NVMe Targets MAD * @vhost: ibmvfc host struct * **/ -static void ibmvfc_discover_targets(struct ibmvfc_host *vhost) +static void ibmvfc_discover_nvme_targets(struct ibmvfc_host *vhost) { - struct ibmvfc_event *evt =3D ibmvfc_get_disc_event(&vhost->scsi_scrqs); + struct ibmvfc_event *evt =3D ibmvfc_get_disc_event(&vhost->nvme_scrqs, + ibmvfc_discover_nvme_targets_done); int level =3D IBMVFC_DEFAULT_LOG_LEVEL; =20 if (!evt) { - ibmvfc_log(vhost, level, "Discover SCSI Targets failed: no available eve= nts\n"); + ibmvfc_log(vhost, level, "Discover NVMe Targets failed: no available eve= nts\n"); ibmvfc_hard_reset_host(vhost); return; } @@ -5229,29 +5267,34 @@ static void ibmvfc_discover_targets(struct ibmvfc_h= ost *vhost) ibmvfc_set_host_action(vhost, IBMVFC_HOST_ACTION_INIT_WAIT); =20 if (!ibmvfc_send_event(evt, vhost, default_timeout)) - ibmvfc_dbg(vhost, "Sent discover SCSI targets\n"); + ibmvfc_dbg(vhost, "Sent discover NVMe targets\n"); else - goto link_down; + ibmvfc_link_down(vhost, IBMVFC_LINK_DEAD); +} =20 - if (!ibmvfc_nvme_active(vhost)) - return; +/** + * ibmvfc_discover_targets - Send Discover SCSI Targets MAD + * @vhost: ibmvfc host struct + * + **/ +static void ibmvfc_discover_targets(struct ibmvfc_host *vhost) +{ + struct ibmvfc_event *evt =3D ibmvfc_get_disc_event(&vhost->scsi_scrqs, + ibmvfc_discover_scsi_targets_done); + int level =3D IBMVFC_DEFAULT_LOG_LEVEL; =20 - evt =3D ibmvfc_get_disc_event(&vhost->nvme_scrqs); if (!evt) { - ibmvfc_log(vhost, level, "Discover NVMe Targets failed: no available eve= nts\n"); + ibmvfc_log(vhost, level, "Discover SCSI Targets failed: no available eve= nts\n"); ibmvfc_hard_reset_host(vhost); return; } =20 + ibmvfc_set_host_action(vhost, IBMVFC_HOST_ACTION_INIT_WAIT); + if (!ibmvfc_send_event(evt, vhost, default_timeout)) - ibmvfc_dbg(vhost, "Sent discover NVMe targets\n"); + ibmvfc_dbg(vhost, "Sent discover SCSI targets\n"); else - goto link_down; - - return; - -link_down: - ibmvfc_link_down(vhost, IBMVFC_LINK_DEAD); + ibmvfc_link_down(vhost, IBMVFC_LINK_DEAD); } =20 static void ibmvfc_fabric_login_nvme_done(struct ibmvfc_event *evt) --=20 2.55.0