[PATCH v2] nvme: remove stale namespaces by NSID range during scan

[PATCH v2] nvme: remove stale namespaces by NSID range during scan

[Mohamed Khalfella]

nvme_scan_ns_list() drops the stale namespaces in each gap in the
reported NSID list one NSID at a time. Every iteration calls
nvme_find_get_ns() to look the namespace up and removes it if it is
present. The loop runs once per NSID in the gap rather than once per
namespace actually present.

NSIDs are 32-bit, so a target with a sparse NSID space can make a
single gap spin the loop billions of times with nothing to remove.

  watchdog: BUG: soft lockup - CPU#4 stuck for 26s!
  Workqueue: nvme-wq nvme_scan_work [nvme_core]
  RIP: 0010:__srcu_read_unlock+0xb/0x20
  Call Trace:
   nvme_find_get_ns+0x7d/0xb0 [nvme_core]
   nvme_scan_ns_list+0xe8/0x280 [nvme_core]
   nvme_scan_work+0x18a/0x280 [nvme_core]
   process_one_work+0x197/0x380
   worker_thread+0x2fe/0x410
   kthread+0xe0/0x100

Rename nvme_remove_invalid_namespaces() to nvme_remove_nsid_range()
and give it an open (start, end) NSID range. ctrl->namespaces is
sorted by NSID, so the whole gap is dropped in a single walk that
stops once end is reached. This bounds the work by the namespaces
that are present instead of by the size of the gap.

Fixes: 540c801c65eb ("NVMe: Implement namespace list scanning")
Signed-off-by: Mohamed Khalfella <mkhalfella@purestorage.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
---
 drivers/nvme/host/core.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 5f2744be7388..cc014cdc72ff 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -155,8 +155,6 @@ static const struct class nvme_ns_chr_class = {
 };
 
 static void nvme_put_subsystem(struct nvme_subsystem *subsys);
-static void nvme_remove_invalid_namespaces(struct nvme_ctrl *ctrl,
-					   unsigned nsid);
 static void nvme_update_keep_alive(struct nvme_ctrl *ctrl,
 				   struct nvme_command *cmd);
 static int nvme_get_log_lsi(struct nvme_ctrl *ctrl, u32 nsid, u8 log_page,
@@ -4513,15 +4511,16 @@ static void nvme_scan_ns_async(void *data, async_cookie_t cookie)
 	nvme_scan_ns(scan_info->ctrl, nsid);
 }
 
-static void nvme_remove_invalid_namespaces(struct nvme_ctrl *ctrl,
-					unsigned nsid)
+static void nvme_remove_nsid_range(struct nvme_ctrl *ctrl, u32 start, u32 end)
 {
 	struct nvme_ns *ns, *next;
 	LIST_HEAD(rm_list);
 
 	mutex_lock(&ctrl->namespaces_lock);
 	list_for_each_entry_safe(ns, next, &ctrl->namespaces, list) {
-		if (ns->head->ns_id > nsid) {
+		if (ns->head->ns_id >= end)
+			break;
+		if (ns->head->ns_id > start) {
 			list_del_rcu(&ns->list);
 			synchronize_srcu(&ctrl->srcu);
 			list_add_tail_rcu(&ns->list, &rm_list);
@@ -4571,13 +4570,14 @@ static int nvme_scan_ns_list(struct nvme_ctrl *ctrl)
 				goto out;
 			async_schedule_domain(nvme_scan_ns_async, &scan_info,
 						&domain);
-			while (++prev < nsid)
-				nvme_ns_remove_by_nsid(ctrl, prev);
+			if (prev + 1 < nsid)
+				nvme_remove_nsid_range(ctrl, prev, nsid);
+			prev = max(prev + 1, nsid);
 		}
 		async_synchronize_full_domain(&domain);
 	}
  out:
-	nvme_remove_invalid_namespaces(ctrl, prev);
+	nvme_remove_nsid_range(ctrl, prev, UINT_MAX);
  free:
 	async_synchronize_full_domain(&domain);
 	kfree(ns_list);
@@ -4597,7 +4597,7 @@ static void nvme_scan_ns_sequential(struct nvme_ctrl *ctrl)
 	for (i = 1; i <= nn; i++)
 		nvme_scan_ns(ctrl, i);
 
-	nvme_remove_invalid_namespaces(ctrl, nn);
+	nvme_remove_nsid_range(ctrl, nn, UINT_MAX);
 }
 
 static void nvme_clear_changed_ns_log(struct nvme_ctrl *ctrl)
-- 
2.54.0

Re: [PATCH v2] nvme: remove stale namespaces by NSID range during scan

[Randy Jennings]

On Sat, Aug 22, 2026 at 5:47 PM Mohamed Khalfella
<mkhalfella@purestorage.com> wrote:
>
> nvme_scan_ns_list() drops the stale namespaces in each gap in the
> reported NSID list one NSID at a time. Every iteration calls
> nvme_find_get_ns() to look the namespace up and removes it if it is
> present. The loop runs once per NSID in the gap rather than once per
> namespace actually present.
>
> NSIDs are 32-bit, so a target with a sparse NSID space can make a
> single gap spin the loop billions of times with nothing to remove.
>
>   watchdog: BUG: soft lockup - CPU#4 stuck for 26s!
>   Workqueue: nvme-wq nvme_scan_work [nvme_core]
>   RIP: 0010:__srcu_read_unlock+0xb/0x20
>   Call Trace:
>    nvme_find_get_ns+0x7d/0xb0 [nvme_core]
>    nvme_scan_ns_list+0xe8/0x280 [nvme_core]
>    nvme_scan_work+0x18a/0x280 [nvme_core]
>    process_one_work+0x197/0x380
>    worker_thread+0x2fe/0x410
>    kthread+0xe0/0x100
>
> Rename nvme_remove_invalid_namespaces() to nvme_remove_nsid_range()
> and give it an open (start, end) NSID range. ctrl->namespaces is
> sorted by NSID, so the whole gap is dropped in a single walk that
> stops once end is reached. This bounds the work by the namespaces
> that are present instead of by the size of the gap.
>
> Fixes: 540c801c65eb ("NVMe: Implement namespace list scanning")
> Signed-off-by: Mohamed Khalfella <mkhalfella@purestorage.com>
> Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Randy Jennings <randyj@purestorage.com>

> ---
>  drivers/nvme/host/core.c | 18 +++++++++---------

> -static void nvme_remove_invalid_namespaces(struct nvme_ctrl *ctrl,
> -                                       unsigned nsid)
> +static void nvme_remove_nsid_range(struct nvme_ctrl *ctrl, u32 start, u32 end)
It is not intuitive to me that start is non-inclusive.  May we add
a comment to that effect?

>  {
>         struct nvme_ns *ns, *next;
>         LIST_HEAD(rm_list);
>
>         mutex_lock(&ctrl->namespaces_lock);
>         list_for_each_entry_safe(ns, next, &ctrl->namespaces, list) {
> -               if (ns->head->ns_id > nsid) {
> +               if (ns->head->ns_id >= end)
> +                       break;
> +               if (ns->head->ns_id > start) {
>                         list_del_rcu(&ns->list);

Re: [PATCH v2] nvme: remove stale namespaces by NSID range during scan

[Keith Busch]

On Sat, Aug 22, 2026 at 05:46:41PM -0700, Mohamed Khalfella wrote:
> nvme_scan_ns_list() drops the stale namespaces in each gap in the
> reported NSID list one NSID at a time. Every iteration calls
> nvme_find_get_ns() to look the namespace up and removes it if it is
> present. The loop runs once per NSID in the gap rather than once per
> namespace actually present.
> 
> NSIDs are 32-bit, so a target with a sparse NSID space can make a
> single gap spin the loop billions of times with nothing to remove.

Thanks, applied to nvme-7.3.

Re: [PATCH v2] nvme: remove stale namespaces by NSID range during scan

[Mohamed Khalfella]

On Mon 2026-08-24 17:21:26 -0700, Randy Jennings wrote:
> On Sat, Aug 22, 2026 at 5:47 PM Mohamed Khalfella
> <mkhalfella@purestorage.com> wrote:
> >
> > nvme_scan_ns_list() drops the stale namespaces in each gap in the
> > reported NSID list one NSID at a time. Every iteration calls
> > nvme_find_get_ns() to look the namespace up and removes it if it is
> > present. The loop runs once per NSID in the gap rather than once per
> > namespace actually present.
> >
> > NSIDs are 32-bit, so a target with a sparse NSID space can make a
> > single gap spin the loop billions of times with nothing to remove.
> >
> >   watchdog: BUG: soft lockup - CPU#4 stuck for 26s!
> >   Workqueue: nvme-wq nvme_scan_work [nvme_core]
> >   RIP: 0010:__srcu_read_unlock+0xb/0x20
> >   Call Trace:
> >    nvme_find_get_ns+0x7d/0xb0 [nvme_core]
> >    nvme_scan_ns_list+0xe8/0x280 [nvme_core]
> >    nvme_scan_work+0x18a/0x280 [nvme_core]
> >    process_one_work+0x197/0x380
> >    worker_thread+0x2fe/0x410
> >    kthread+0xe0/0x100
> >
> > Rename nvme_remove_invalid_namespaces() to nvme_remove_nsid_range()
> > and give it an open (start, end) NSID range. ctrl->namespaces is
> > sorted by NSID, so the whole gap is dropped in a single walk that
> > stops once end is reached. This bounds the work by the namespaces
> > that are present instead of by the size of the gap.
> >
> > Fixes: 540c801c65eb ("NVMe: Implement namespace list scanning")
> > Signed-off-by: Mohamed Khalfella <mkhalfella@purestorage.com>
> > Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
> Reviewed-by: Randy Jennings <randyj@purestorage.com>
> 
> > ---
> >  drivers/nvme/host/core.c | 18 +++++++++---------
> 
> > -static void nvme_remove_invalid_namespaces(struct nvme_ctrl *ctrl,
> > -                                       unsigned nsid)
> > +static void nvme_remove_nsid_range(struct nvme_ctrl *ctrl, u32 start, u32 end)
> It is not intuitive to me that start is non-inclusive.  May we add
> a comment to that effect?

Yes, it is not intuitive. [start, end) makes more sense IMO. That is
said, this is how nvme_remove_invalid_namespaces() worked and I decided
not to change that because it is not part of the fix. I do not think a
comment will make a big difference here. The next person who works on
this code will read the nvme_remove_nsid_range(), it is a short
function, and figure out how it works.

> 
> >  {
> >         struct nvme_ns *ns, *next;
> >         LIST_HEAD(rm_list);
> >
> >         mutex_lock(&ctrl->namespaces_lock);
> >         list_for_each_entry_safe(ns, next, &ctrl->namespaces, list) {
> > -               if (ns->head->ns_id > nsid) {
> > +               if (ns->head->ns_id >= end)
> > +                       break;
> > +               if (ns->head->ns_id > start) {
> >                         list_del_rcu(&ns->list);