Re: [PATCH 13/20] scsi: ibmvfc: make NVMe FCP abort callback asynchronous

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] scsi: ibmvfc: target refcount leak in NVMe FCP abort on H_CLOSED
--

commit a157bd312e6543b5cff40822ea7bcdd2ca4fce9c
Author: Tyrel Datwyler <tyreld@linux.ibm.com>

scsi: ibmvfc: make NVMe FCP abort callback asynchronous

This commit replaces the synchronous NVMe FCP abort callback with a
dedicated asynchronous callback to prevent stalling the timeout workqueue.
It removes the completion waiting logic and allows the transport to wait
independently for the original exchange to complete.

> diff --git a/drivers/scsi/ibmvscsi/ibmvfc-nvme.c b/drivers/scsi/ibmvscsi/ibmvfc-nvme.c
> index d9f280c658eb4..52e2621a43424 100644
> --- a/drivers/scsi/ibmvscsi/ibmvfc-nvme.c
> +++ b/drivers/scsi/ibmvscsi/ibmvfc-nvme.c
[ ... ]
> @@ -426,27 +434,12 @@ static void ibmvfc_nvme_fcp_abort(struct nvme_fc_local_port *lport,
>  
>  	spin_lock_irqsave(queue->q_lock, flags);
>  	kref_get(&tgt->kref);
> -	ibmvfc_init_event(evt, ibmvfc_sync_nvme_completion, IBMVFC_MAD_FORMAT);
> +	ibmvfc_init_event(evt, ibmvfc_nvme_fcp_abort_done, IBMVFC_MAD_FORMAT);
>  	ibmvfc_init_fcp_abort(evt, abort_req);
> -	evt->sync_iu = &rsp;
> -
> -	if (ibmvfc_send_event(evt, vhost, default_timeout))
> -		goto out;
> +	evt->tgt = tgt;
>  
> +	ibmvfc_send_event(evt, vhost, default_timeout);
>  	spin_unlock_irqrestore(queue->q_lock, flags);

[Severity: Medium]
Will this leak the target kref if ibmvfc_send_event() encounters an H_CLOSED
error?

When ibmvfc_send_event() receives an H_CLOSED transport state error, it frees
the event and returns SCSI_MLQUEUE_HOST_BUSY without invoking the evt->done
callback:

drivers/scsi/ibmvscsi/ibmvfc-core.c:ibmvfc_send_event() {
	...
	if (rc) {
		...
		if (rc == H_CLOSED) {
			...
			ibmvfc_free_event(evt);
			return SCSI_MLQUEUE_HOST_BUSY;
		}
	...
}

Because ibmvfc_nvme_fcp_abort() now ignores the return value of
ibmvfc_send_event(), the kref incremented earlier in the function will never
be dropped if this H_CLOSED path is taken. Should the return value of
ibmvfc_send_event() be checked so the kref can be released on error?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260916230921.2204729-1-tyreld@linux.ibm.com?part=13