Re: [PATCH 24/29] ibmvfc: implement LLDD callbacks for mapping nvme-fc queues

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Lockless double-read of `vhost->nvme_scrqs.active_queues` can cause a division-by-zero kernel panic.
--

commit fd68a3e765846c041d31997c784f4e4a733bb8aa
Author: Tyrel Datwyler <tyreld@linux.ibm.com>

ibmvfc: implement LLDD callbacks for mapping nvme-fc queues

This commit implements the NVMe-FC queue create and delete callbacks. It maps
NVMe controller queues onto ibmvfc hardware queues using the qidx.

> diff --git a/drivers/scsi/ibmvscsi/ibmvfc-nvme.c b/drivers/scsi/ibmvscsi/ibmvfc-nvme.c
> index fc4337fc9b3fb..1108d11d6b2db 100644
> --- a/drivers/scsi/ibmvscsi/ibmvfc-nvme.c
> +++ b/drivers/scsi/ibmvscsi/ibmvfc-nvme.c

[ ... ]

> @@ -28,6 +28,40 @@ static void ibmvfc_nvme_remoteport_delete(struct nvme_fc_remote_port *rport)
>  	complete(&tgt->nvme_delete_done);
>  }
>  
> +static int ibmvfc_nvme_create_queue(struct nvme_fc_local_port *lport, unsigned int qidx,
> +				    u16 qsize, void **handle)
> +{
> +	struct ibmvfc_host *vhost = lport->private;
> +	struct ibmvfc_nvme_qhandle *qhandle;
> +
> +	if (!vhost->nvme_scrqs.active_queues)
> +		return -ENODEV;
> +
> +	qhandle = kzalloc_obj(struct ibmvfc_nvme_qhandle);
> +	if (!qhandle)
> +		return -ENOMEM;
> +
> +	qhandle->cpu_id = raw_smp_processor_id();
> +	qhandle->qidx = qidx;
> +
> +	/* Admin and first IO queue are both mapped to index 0 */
> +	if (qidx)
> +		qhandle->index = (qidx - 1) % vhost->nvme_scrqs.active_queues;

[Severity: High]
Could a lockless double-read of vhost->nvme_scrqs.active_queues lead to a
division by zero?

If a concurrent host reset or channel setup failure sets active_queues to 0,
it seems the compiler could reload the value for the modulo operation since
the memory allocation acts as a compiler barrier.

Would reading active_queues once into a local variable prevent a potential
kernel panic here?

> +	else
> +		qhandle->index = qidx;
> +
> +	qhandle->queue = &vhost->nvme_scrqs.scrqs[qhandle->index];
> +
> +	*handle = qhandle;
> +	return 0;
> +}

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260623013035.3436640-1-tyreld@linux.ibm.com?part=24