Re: [PATCH 12/29] ibmvfc: add NVMe/FC Implicit Logout and Move Login support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing NULL pointer check on the event allocated for implicit logout in `ibmvfc_tgt_implicit_logout_and_del()`, leading to a crash in `ibmvfc_send_event()`.
--

commit d7f6f97d0c832e12c02c910b6675c0a3be2fb197
Author: Tyrel Datwyler <tyreld@linux.ibm.com>

ibmvfc: add NVMe/FC Implicit Logout and Move Login support

This patch adds protocol-specific handling for implicit logout and
move-login operations on NVMe/FC targets. It extends the existing target
relogin and migration flows by selecting NVMe/FC-specific opcodes and
updating the associated logging.

> diff --git a/drivers/scsi/ibmvscsi/ibmvfc-core.c b/drivers/scsi/ibmvscsi/ibmvfc-core.c
> index 53480d150042e..3e3d77e0d5172 100644
> --- a/drivers/scsi/ibmvscsi/ibmvfc-core.c
> +++ b/drivers/scsi/ibmvscsi/ibmvfc-core.c
[ ... ]
> @@ -4456,7 +4461,7 @@ static void ibmvfc_tgt_implicit_logout_and_del(struct ibmvfc_target *tgt)
>  		ibmvfc_set_tgt_action(tgt, IBMVFC_TGT_ACTION_DEL_RPORT);
>  		kref_put(&tgt->kref, ibmvfc_release_tgt);
>  	} else
> -		tgt_dbg(tgt, "Sent Implicit Logout\n");
> +		tgt_dbg(tgt, "%s Sent Implicit Logout\n", proto_type[tgt->protocol]);
>  }

[Severity: High]
This is a pre-existing issue, but does ibmvfc_tgt_implicit_logout_and_del()
need to check if evt is NULL before calling ibmvfc_send_event()?

If the reserved event pool is exhausted, __ibmvfc_tgt_get_implicit_logout_evt()
can return NULL:

ibmvfc-core.c:__ibmvfc_tgt_get_implicit_logout_evt() {
        ...
        evt = ibmvfc_get_reserved_event(&vhost->crq);
        if (!evt)
                return NULL;
        ...
}

Unlike other callers such as ibmvfc_tgt_implicit_logout(), this function
lacks a NULL check and passes the evt pointer directly to ibmvfc_send_event(),
which unconditionally dereferences it:

ibmvfc-core.c:ibmvfc_send_event() {
        __be64 *crq_as_u64 = (__be64 *) &evt->crq;
        ...
}

Could this lead to a NULL pointer dereference under heavy queue pressure
or concurrent target teardowns?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260623013035.3436640-1-tyreld@linux.ibm.com?part=12