Re: [PATCH v2 21/33] ibmvfc: delete NVMe/FC targets as well as SCSI

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] NVMe targets marked for deletion are never processed by the host's worker thread, leading to a stalled state machine and memory leaks.
--

--- Patch [21]: [PATCH v2 21/33] ibmvfc: delete NVMe/FC targets as well as SCSI ---
commit a374ffc0e25726714a6472bd16a2cbadb3641666
Author: Tyrel Datwyler <tyreld@linux.ibm.com>

ibmvfc: delete NVMe/FC targets as well as SCSI

This commit extends target deletion paths to process NVMe targets as well
as SCSI targets. Link-down and host reinitialization flows are updated to
walk both the SCSI and NVMe target lists when marking targets for deletion
to ensure protocol-specific target state stays consistent.

> diff --git a/drivers/scsi/ibmvscsi/ibmvfc-core.c b/drivers/scsi/ibmvscsi/ibmvfc-core.c
> index 92c286cfc69c6..1185d72a8a734 100644
> --- a/drivers/scsi/ibmvscsi/ibmvfc-core.c
> +++ b/drivers/scsi/ibmvscsi/ibmvfc-core.c
> @@ -714,6 +714,8 @@ static void ibmvfc_link_down(struct ibmvfc_host *vhost,
>  	scsi_block_requests(vhost->host);
>  	list_for_each_entry(tgt, &vhost->scsi_scrqs.targets, queue)
>  		ibmvfc_del_tgt(tgt);
> +	list_for_each_entry(tgt, &vhost->nvme_scrqs.targets, queue)
> +		ibmvfc_del_tgt(tgt);

[Severity: High]
When ibmvfc_del_tgt() is called here for NVMe targets, it sets the target
action and wakes the host's background worker thread (via work_wait_q). Will
these NVMe targets actually get processed by the worker thread?

Looking at the worker thread execution in ibmvfc_do_work():

drivers/scsi/ibmvscsi/ibmvfc-core.c:ibmvfc_do_work() {
    ...
    case IBMVFC_HOST_ACTION_TGT_DEL:
    case IBMVFC_HOST_ACTION_TGT_DEL_FAILED:
        list_for_each_entry(tgt, &vhost->scsi_scrqs.targets, queue) {
            if (tgt->action == IBMVFC_TGT_ACTION_LOGOUT_RPORT) {
                tgt->job_step(tgt);
                break;
            }
        }
    ...
}

And similarly in the helper function:

drivers/scsi/ibmvscsi/ibmvfc-core.c:ibmvfc_dev_logo_to_do() {
    ...
    list_for_each_entry(tgt, &vhost->scsi_scrqs.targets, queue) {
    ...
}

Both functions strictly iterate over vhost->scsi_scrqs.targets and completely
ignore vhost->nvme_scrqs.targets. Does this leave the NVMe targets stranded
in a pending logout state, resulting in a stalled state machine and memory
leak for the target structures?

>  	ibmvfc_set_host_state(vhost, state);
>  	ibmvfc_set_host_action(vhost, IBMVFC_HOST_ACTION_TGT_DEL);
>  	vhost->events_to_log |= IBMVFC_AE_LINKDOWN;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260723000149.969416-1-tyreld@linux.ibm.com?part=21