Re: [PATCH v4] scsi: lpfc: Fix race conditions in ELS retry handling

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] scsi: lpfc: missing Fixes trailer and stale race description in
  changelog
--

commit c4e00459dde635d0b5ecc529a001464e7b80a848
Author: Kyle Mahlkuch <kmahlkuc@linux.ibm.com>

> scsi: lpfc: Fix race conditions in ELS retry handling
>
> This patch addresses a race condition in the lpfc driver's ELS retry
> event handling that can lead to a use-after-free in the
> lpfc_cancel_retry_delay_tmo(), where the NLP_DELAY_TMO flag is cleared
> before acquiring the lock to check if the retry event is queued. This
> creates a window where the timer can be rescheduled and fire, causing
> both the cancel path and the worker thread to release the same reference,
> resulting in a double-put and use-after-free.
>
> Moved capture ndlp and clear evt_arg1 under hbalock while dequeuing
> LPFC_EVT_ELS_RETRY in lpfc_work_list_done().
>
> Signed-off-by: Kyle Mahlkuch <kmahlkuc@linux.ibm.com>

[Severity: Low]
This fixes the unlocked els_retry_evt removal and lpfc_nlp_put() in
lpfc_cancel_retry_delay_tmo(). Should the commit message include:

  Fixes: e47c9093531d ("[SCSI] lpfc 8.2.5 : Correct ndlp referencing issues")

Also, is the first paragraph of the commit message still accurate? The code
still clears NLP_DELAY_TMO and calls timer_delete_sync() before taking
phba->hbalock, and fixes the double-put race by serializing els_retry_evt
dequeue and evt_arg1 consumption under phba->hbalock.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/dcea48dd-f76c-4bb0-9275-c12ef9bd78a2@linux.ibm.com?part=1