Re: [PATCH 15/20] scsi: ibmvfc: unregister NVMe local port on adapter removal

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] scsi: ibmvfc: deadlock in ibmvfc_nvme_unregister() during adapter removal
--

commit 58109a2f9e0799681cadb400cd50fd44f1f7c337
Author: Tyrel Datwyler <tyreld@linux.ibm.com>

scsi: ibmvfc: unregister NVMe local port on adapter removal

This commit adds a call to ibmvfc_nvme_unregister() during adapter removal
to prevent a use-after-free in the NVMe-FC transport layer. It ensures the
local port is unregistered before the host memory is freed.

> diff --git a/drivers/scsi/ibmvscsi/ibmvfc-core.c b/drivers/scsi/ibmvscsi/ibmvfc-core.c
> --- a/drivers/scsi/ibmvscsi/ibmvfc-core.c
> +++ b/drivers/scsi/ibmvscsi/ibmvfc-core.c
> @@ -6995,6 +6995,8 @@ static void ibmvfc_remove(struct vio_dev *vdev)
>  	ibmvfc_release_sub_crqs(vhost);
>  	ibmvfc_release_crq_queue(vhost);
>  
> +	ibmvfc_nvme_unregister(vhost);

[Severity: High]
Could this unregister call block forever if the adapter reset times out?

Earlier in ibmvfc_remove(), ibmvfc_wait_while_resetting() waits for the 
adapter to finish resetting. If this wait times out, kthread_stop() is called
on the worker thread. The worker thread will then exit and abandon any
remaining NVMe remote ports that needed deletion.

Because these remote ports are never unregistered, the local port's active
remote port count remains greater than zero.

When ibmvfc_nvme_unregister() is called here, it invokes
nvme_fc_unregister_localport(), which defers the localport_delete callback
until all remote ports are deleted. It then unconditionally blocks:

ibmvfc_nvme_unregister() {
        ...
        rc = nvme_fc_unregister_localport(vhost->nvme_local_port);
        if (!rc) {
                wait_for_completion(&vhost->nvme_delete_done);
        ...
}

Since the worker thread is dead and will never delete the remaining remote
ports, will this completion never be signaled, resulting in a permanent hang
of the driver removal process?

> +
>  	ibmvfc_free_mem(vhost);
>  	spin_lock(&ibmvfc_driver_lock);
>  	list_del(&vhost->queue);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260916230921.2204729-1-tyreld@linux.ibm.com?part=15