scsi: lpfc: Fix kref imbalance on fabric ndlps from dev_loss_tmo handler

With a FLOGI outstanding and loss of physical link connection to the fabric
for the duration of dev_loss_tmo, there is a fabric ndlp kref imbalance
that decrements the kref and sets the NLP_IN_RECOV_POST_DEV_LOSS flag at
the same time.

The issue is that when the FLOGI completion routine executes, the fabric
ndlp could already be freed because of the final kref put from the
dev_loss_tmo handler.  Fix by early returning before the ndlp kref put if
the ndlp is deemed a candidate for NLP_IN_RECOV_POST_DEV_LOSS in the FLOGI
completion routine.

Signed-off-by: Justin Tee <justin.tee@broadcom.com>
Link: https://lore.kernel.org/r/20240912232447.45607-5-justintee8345@gmail.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c
index 35c9181..9241075 100644 (file)
--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
+++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
@@ -527,6 +527,9 @@ lpfc_dev_loss_tmo_handler(struct lpfc_nodelist *ndlp)
                 * the following lpfc_nlp_put is necessary after fabric node is
                 * recovered.
                 */
+               spin_lock_irqsave(&ndlp->lock, iflags);
+               ndlp->nlp_flag &= ~NLP_IN_DEV_LOSS;
+               spin_unlock_irqrestore(&ndlp->lock, iflags);
                if (recovering) {
                        lpfc_printf_vlog(vport, KERN_INFO,
                                         LOG_DISCOVERY | LOG_NODE,
@@ -539,6 +542,7 @@ lpfc_dev_loss_tmo_handler(struct lpfc_nodelist *ndlp)
                        spin_lock_irqsave(&ndlp->lock, iflags);
                        ndlp->save_flags |= NLP_IN_RECOV_POST_DEV_LOSS;
                        spin_unlock_irqrestore(&ndlp->lock, iflags);
+                       return fcf_inuse;
                } else if (ndlp->nlp_state == NLP_STE_UNMAPPED_NODE) {
                        /* Fabric node fully recovered before this dev_loss_tmo
                         * queue work is processed.  Thus, ignore the
@@ -552,15 +556,9 @@ lpfc_dev_loss_tmo_handler(struct lpfc_nodelist *ndlp)
                                         ndlp->nlp_DID, kref_read(&ndlp->kref),
                                         ndlp, ndlp->nlp_flag,
                                         vport->port_state);
-                       spin_lock_irqsave(&ndlp->lock, iflags);
-                       ndlp->nlp_flag &= ~NLP_IN_DEV_LOSS;
-                       spin_unlock_irqrestore(&ndlp->lock, iflags);
                        return fcf_inuse;
                }
 
-               spin_lock_irqsave(&ndlp->lock, iflags);
-               ndlp->nlp_flag &= ~NLP_IN_DEV_LOSS;
-               spin_unlock_irqrestore(&ndlp->lock, iflags);
                lpfc_nlp_put(ndlp);
                return fcf_inuse;
        }