[PATCH v2] scsi: storvsc: Support manual scans for all Hyper-V targets

[PATCH v2] scsi: storvsc: Support manual scans for all Hyper-V targets

[Laurence Oberman]

The Fibre Channel transport topology created by storvsc exposes only one
dummy remote port per SCSI host. Its scsi_target_id is always zero.

As a result, the FC transport user-scan path looks up the remote port using
target ID 0. It cannot initiate a scan for Target 1 or higher. No SCSI
command is therefore sent to Hyper-V when userspace explicitly requests a
scan of one of these targets.

storvsc itself supports up to STORVSC_FC_MAX_TARGETS and already passes
scmnd->device->id to Hyper-V as vm_srb->target_id. Devices on Target 1 and
higher work when initially discovered. They can also be rediscovered by a
full host scan, such as the scan triggered after an FC port bounce.

Provide a storvsc-specific user_scan callback that uses the exported
scsi_scan_target() interface. Iterate over the requested channel and target
ranges so that wildcard and explicitly addressed scans retain the expected
SCSI sysfs scan semantics.

This bypasses the single-rport lookup in fc_user_scan() and allows
userspace to explicitly scan any target supported by storvsc without
requiring one synthetic fc_rport for every Hyper-V target.

Signed-off-by: Laurence Oberman <loberman@redhat.com>
---

Changes in v2:
- Replace the private, unexported scsi_scan_host_selected() helper with
  the exported scsi_scan_target() interface.
- Preserve wildcard channel and target scan behavior.
- Verify that storvsc_eh_timed_out() does not use the FC error-handler
  helpers; the reported missing-rport dereference is not present.

 drivers/scsi/storvsc_drv.c | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
index 571ea549152b..58b6ae96d03f 100644
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -520,6 +520,36 @@ static void storvsc_host_scan(struct work_struct *work)
 	scsi_scan_host(host);
 }
 
+#if IS_ENABLED(CONFIG_SCSI_FC_ATTRS)
+static int storvsc_user_scan(struct Scsi_Host *host,
+			     unsigned int channel,
+			     unsigned int id,
+			     u64 lun)
+{
+	unsigned int first_channel, last_channel;
+	unsigned int first_id, end_id;
+	unsigned int ch, target;
+
+	if ((channel != SCAN_WILD_CARD && channel > host->max_channel) ||
+	    (id != SCAN_WILD_CARD && id >= host->max_id) ||
+	    (lun != SCAN_WILD_CARD && lun >= host->max_lun))
+		return -EINVAL;
+
+	first_channel = channel == SCAN_WILD_CARD ? 0 : channel;
+	last_channel = channel == SCAN_WILD_CARD ? host->max_channel : channel;
+	first_id = id == SCAN_WILD_CARD ? 0 : id;
+	end_id = id == SCAN_WILD_CARD ? host->max_id : id + 1;
+
+	for (ch = first_channel; ch <= last_channel; ch++) {
+		for (target = first_id; target < end_id; target++)
+			scsi_scan_target(&host->shost_gendev, ch, target, lun,
+					 SCSI_SCAN_MANUAL);
+	}
+
+	return 0;
+}
+#endif
+
 static void storvsc_remove_lun(struct work_struct *work)
 {
 	struct storvsc_scan_work *wrk;
@@ -2232,6 +2262,8 @@ static int __init storvsc_drv_init(void)
 	fc_transport_template = fc_attach_transport(&fc_transport_functions);
 	if (!fc_transport_template)
 		return -ENODEV;
+
+	fc_transport_template->user_scan = storvsc_user_scan;
 #endif
 
 	ret = vmbus_driver_register(&storvsc_drv);
-- 
2.55.0

Re: [PATCH v2] scsi: storvsc: Support manual scans for all Hyper-V targets

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [High] Kernel panic in fc_eh_timed_out() due to missing NULL check for fc_rport, contradicting the v2 changelog claim.
- [High] Use-After-Free race condition in fc_user_scan_tgt due to unpinned rport pointer.
--

--- Patch [1]: [PATCH v2] scsi: storvsc: Support manual scans for all Hyper-V targets ---
commit 7a84d34942989f4df1a7195141939c24f221c9ea
Author: Laurence Oberman <loberman@redhat.com>

scsi: storvsc: Support manual scans for all Hyper-V targets

This patch provides a storvsc-specific user_scan callback that uses the
exported scsi_scan_target() interface to allow explicit scanning of targets
without requiring synthetic fc_rports for each target.

> ---
> Changes in v2:
> - Replace the private, unexported scsi_scan_host_selected() helper with
>   the exported scsi_scan_target() interface.
> - Preserve wildcard channel and target scan behavior.
> - Verify that storvsc_eh_timed_out() does not use the FC error-handler
>   helpers; the reported missing-rport dereference is not present.

[Severity: High]
This isn't a bug introduced by this patch, but is the v2 changelog accurate
regarding storvsc_eh_timed_out()?

Looking at storvsc_eh_timed_out() in drivers/scsi/storvsc_drv.c, it appears
to explicitly route I/O timeouts to the FC transport error handler:

if (scmnd->device->host->transportt == fc_transport_template)
        return fc_eh_timed_out(scmnd);

When fc_eh_timed_out() handles this, it extracts the fc_rport pointer:

struct fc_rport *rport = starget_to_rport(scsi_target(scmd->device));
if (rport->port_state == FC_PORTSTATE_BLOCKED)

Because storvsc targets are created without an intermediate fc_rport parent,
starget_to_rport() returns NULL. Does this mean fc_eh_timed_out() will
immediately dereference a NULL pointer during an I/O timeout?


As a related observation on the FC transport layer scan paths:

[Severity: High]
This is a pre-existing issue, but does fc_user_scan_tgt() have a race
condition that could lead to a use-after-free?

In drivers/scsi/scsi_transport_fc.c:fc_user_scan_tgt(), the host lock is
dropped before scanning the target:

spin_unlock_irqrestore(shost->host_lock, flags);
scsi_scan_target(&rport->dev, channel, id, lun,
                 SCSI_SCAN_MANUAL);

If a concurrent FC link down event or port removal triggers
fc_rport_final_delete(), can the rport device be removed and freed before
or during the scsi_scan_target() execution? If so, should a reference be
acquired on rport->dev prior to dropping the lock?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260723163743.1274830-1-loberman@redhat.com?part=1

Re: [PATCH v2] scsi: storvsc: Support manual scans for all Hyper-V targets

[Laurence Oberman]

On Thu, 2026-07-23 at 16:51 +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 2 potential
> issue(s) to consider:
> 
> Pre-existing issues:
> - [High] Kernel panic in fc_eh_timed_out() due to missing NULL check
> for fc_rport, contradicting the v2 changelog claim.
> - [High] Use-After-Free race condition in fc_user_scan_tgt due to
> unpinned rport pointer.
> --
> 
> --- Patch [1]: [PATCH v2] scsi: storvsc: Support manual scans for all
> Hyper-V targets ---
> commit 7a84d34942989f4df1a7195141939c24f221c9ea
> Author: Laurence Oberman <loberman@redhat.com>
> 
> scsi: storvsc: Support manual scans for all Hyper-V targets
> 
> This patch provides a storvsc-specific user_scan callback that uses
> the
> exported scsi_scan_target() interface to allow explicit scanning of
> targets
> without requiring synthetic fc_rports for each target.
> 
> > ---
> > Changes in v2:
> > - Replace the private, unexported scsi_scan_host_selected() helper
> > with
> >   the exported scsi_scan_target() interface.
> > - Preserve wildcard channel and target scan behavior.
> > - Verify that storvsc_eh_timed_out() does not use the FC error-
> > handler
> >   helpers; the reported missing-rport dereference is not present.
> 
> [Severity: High]
> This isn't a bug introduced by this patch, but is the v2 changelog
> accurate
> regarding storvsc_eh_timed_out()?
> 
> Looking at storvsc_eh_timed_out() in drivers/scsi/storvsc_drv.c, it
> appears
> to explicitly route I/O timeouts to the FC transport error handler:
> 
> if (scmnd->device->host->transportt == fc_transport_template)
>         return fc_eh_timed_out(scmnd);
> 
> When fc_eh_timed_out() handles this, it extracts the fc_rport
> pointer:
> 
> struct fc_rport *rport = starget_to_rport(scsi_target(scmd->device));
> if (rport->port_state == FC_PORTSTATE_BLOCKED)
> 
> Because storvsc targets are created without an intermediate fc_rport
> parent,
> starget_to_rport() returns NULL. Does this mean fc_eh_timed_out()
> will
> immediately dereference a NULL pointer during an I/O timeout?
> 
> 
> As a related observation on the FC transport layer scan paths:
> 
> [Severity: High]
> This is a pre-existing issue, but does fc_user_scan_tgt() have a race
> condition that could lead to a use-after-free?
> 
> In drivers/scsi/scsi_transport_fc.c:fc_user_scan_tgt(), the host lock
> is
> dropped before scanning the target:
> 
> spin_unlock_irqrestore(shost->host_lock, flags);
> scsi_scan_target(&rport->dev, channel, id, lun,
>                  SCSI_SCAN_MANUAL);
> 
> If a concurrent FC link down event or port removal triggers
> fc_rport_final_delete(), can the rport device be removed and freed
> before
> or during the scsi_scan_target() execution? If so, should a reference
> be
> acquired on rport->dev prior to dropping the lock?

I do not see any of F/C related calls in what I modified or in the code
I worked on so for me v2 is the correct and final version of this.

Thanks
Laurence

Re: [PATCH v2] scsi: storvsc: Support manual scans for all Hyper-V targets

[Martin K. Petersen (Oracle)]

Laurence,

> The Fibre Channel transport topology created by storvsc exposes only
> one dummy remote port per SCSI host. Its scsi_target_id is always
> zero.
>
> As a result, the FC transport user-scan path looks up the remote port
> using target ID 0. It cannot initiate a scan for Target 1 or higher.
> No SCSI command is therefore sent to Hyper-V when userspace explicitly
> requests a scan of one of these targets.

Applied to 7.3/scsi-staging, thanks!

-- 
Martin K. Petersen