Re: [PATCH 19/20] scsi: ibmvfc: fix concurrent SCSI and NVMe discover-targets race dropping targets

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] scsi: ibmvfc: state machine race via orphaned discovery MADs
--

commit 6d8009c8fd10f57d31447688423fb6783763f7d1
Author: Tyrel Datwyler <tyreld@linux.ibm.com>

scsi: ibmvfc: fix concurrent SCSI and NVMe discover-targets race dropping targets

This commit introduces a pending_disc counter to ensure both SCSI and NVMe
discovery-targets MADs complete before proceeding to target allocation. It
increments the counter for each sent MAD and decrements it upon completion,
transitioning to the allocation state only when the counter reaches zero.

> diff --git a/drivers/scsi/ibmvscsi/ibmvfc-core.c b/drivers/scsi/ibmvscsi/ibmvfc-core.c
> index d79a6ae278a2c..b0d9000b4a0d4 100644
> --- a/drivers/scsi/ibmvscsi/ibmvfc-core.c
> +++ b/drivers/scsi/ibmvscsi/ibmvfc-core.c
> @@ -5156,7 +5156,8 @@ static void ibmvfc_discover_targets_done(struct ibmvfc_event *evt)
>  					      max_targets);
>  		ibmvfc_dbg(vhost, "%d %s targets found\n", channels->num_targets,
>  			   proto_type[channels->protocol]);
> -		ibmvfc_set_host_action(vhost, IBMVFC_HOST_ACTION_ALLOC_TGTS);
> +		if (!--vhost->pending_disc)
> +			ibmvfc_set_host_action(vhost, IBMVFC_HOST_ACTION_ALLOC_TGTS);
>  		break;

[Severity: High]
Does this blind decrement safely handle orphaned discovery MADs from a
previous initialization cycle?

If a MAD fails, such as from a transport timeout, it calls
ibmvfc_retry_host_init(). This schedules a retry without canceling other
in-flight MADs:

ibmvfc_retry_host_init()
    if (vhost->action == IBMVFC_HOST_ACTION_INIT_WAIT) {
        ...
        else {
            ibmvfc_set_host_action(vhost, IBMVFC_HOST_ACTION_INIT);
            retry = 1;
        }

When the work thread runs the retry, it executes ibmvfc_discover_targets()
again. This overwrites the pending_disc counter for the new cycle:

ibmvfc_discover_targets()
    ...
    ibmvfc_set_host_action(vhost, IBMVFC_HOST_ACTION_INIT_WAIT);
    vhost->pending_disc = 1;
    ...

Could the original in-flight MAD from the first cycle then complete
successfully, prematurely decrement pending_disc for the new cycle, and
trigger ALLOC_TGTS before all current-cycle MADs finish?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260916230921.2204729-1-tyreld@linux.ibm.com?part=19