Re: [PATCH v2 56/60] scsi: qla2xxx: Initialize NVMe abort_work once at submission

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Unbalanced kref increment when schedule_work() returns false, leading to a permanent command resource leak and NVMe FC transport hang.
--

commit d400422c8159891ac0e43b19f4d841502d8f3491
Author: Nilesh Javali <njavali@marvell.com>

scsi: qla2xxx: Initialize NVMe abort_work once at submission

This commit initializes NVMe abort_work once at command submission
instead of immediately before schedule_work(). This prevents workqueue
corruption when an abort is issued multiple times for the same command.

> diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c
> index 0038b6274d444..3b2f255a5d7d4 100644
> --- a/drivers/scsi/qla2xxx/qla_nvme.c
> +++ b/drivers/scsi/qla2xxx/qla_nvme.c
> @@ -463,7 +463,6 @@ static void qla_nvme_ls_abort(struct nvme_fc_local_port *lport,
>  	}
>  	spin_unlock_irqrestore(&priv->cmd_lock, flags);
>  
> -	INIT_WORK(&priv->abort_work, qla_nvme_abort_work);
>  	schedule_work(&priv->abort_work);

[Severity: High]
Does this code leak the kref when schedule_work() returns false?

Because INIT_WORK() was removed, schedule_work() will now correctly return
false if the work item is already pending (for instance, during concurrent
aborts).

However, qla_nvme_ls_abort() calls kref_get_unless_zero(&priv->sp->cmd_kref)
before schedule_work(). If schedule_work() returns false, the work function
qla_nvme_abort_work() will only execute once and therefore call kref_put()
only once. 

Doesn't this leave the extra kref leaked, preventing the command from ever
completing and potentially hanging the NVMe FC transport?

[ ... ]

> @@ -545,7 +545,6 @@ static void qla_nvme_fcp_abort(struct nvme_fc_local_port *lport,
>  	}
>  	spin_unlock_irqrestore(&priv->cmd_lock, flags);
>  
> -	INIT_WORK(&priv->abort_work, qla_nvme_abort_work);
>  	schedule_work(&priv->abort_work);

[Severity: High]
Similarly in qla_nvme_fcp_abort(), does this code also leak the kref if
schedule_work() returns false?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260612095333.1666592-1-njavali@marvell.com?part=56