scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology

In point-to-point topology, the driver sometimes defers the unsolicited
FLOGI LS_ACC until it sends its FLOGI to the remote port.  When this
happens, lpfc neglects to release the ndlp allocated for the unsolicited
FLOGI.  This patch adds code to release the ndlp for the deferred
unsolicited FLOGI LS_ACC.

An NLP_FLOGI_DFR_ACC flag is introduced to facilitate identifying an
ndlp with an expected deferred FLOGI LS_ACC completion.  When
lpfc_cmpl_els_rsp() detects the correct qualifiers, it releases the
initial reference on the ndlp object.  And when lpfc_cmpl_els_rsp()
exits, the remaining put for the deferred action is executed and the
ndlp is released.

Signed-off-by: Justin Tee <justin.tee@broadcom.com>
Link: https://patch.msgid.link/20251106224639.139176-6-justintee8345@gmail.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h
index 224edacf2d8e524ea1780433e3bda0c8bbfcf7a5..8459cf568c1270e92b8636181e76a8de1fa350ff 100644 (file)
--- a/drivers/scsi/lpfc/lpfc.h
+++ b/drivers/scsi/lpfc/lpfc.h
@@ -311,7 +311,6 @@ struct lpfc_defer_flogi_acc {
        u16 rx_id;
        u16 ox_id;
        struct lpfc_nodelist *ndlp;
-
 };
 
 #define LPFC_VMID_TIMER   300  /* timer interval in seconds */

diff --git a/drivers/scsi/lpfc/lpfc_disc.h b/drivers/scsi/lpfc/lpfc_disc.h
index 3d47dc7458d1d16541fcf52328f6ce222bc3d7cc..51cb8571c04928057eac9483eb28a7ccd86a2236 100644 (file)
--- a/drivers/scsi/lpfc/lpfc_disc.h
+++ b/drivers/scsi/lpfc/lpfc_disc.h
@@ -1,7 +1,7 @@
 /*******************************************************************
  * This file is part of the Emulex Linux Device Driver for         *
  * Fibre Channel Host Bus Adapters.                                *
- * Copyright (C) 2017-2024 Broadcom. All Rights Reserved. The term *
+ * Copyright (C) 2017-2025 Broadcom. All Rights Reserved. The term *
  * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.     *
  * Copyright (C) 2004-2013 Emulex.  All rights reserved.           *
  * EMULEX and SLI are trademarks of Emulex.                        *
@@ -208,6 +208,7 @@ enum lpfc_nlp_flag {
                                           NPR list */
        NLP_RM_DFLT_RPI    = 26,        /* need to remove leftover dflt RPI */
        NLP_NODEV_REMOVE   = 27,        /* Defer removal till discovery ends */
+       NLP_FLOGI_DFR_ACC  = 28,        /* FLOGI LS_ACC was Deferred */
        NLP_SC_REQ         = 29,        /* Target requires authentication */
        NLP_FIRSTBURST     = 30,        /* Target supports FirstBurst */
        NLP_RPI_REGISTERED = 31         /* nlp_rpi is valid */

diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
index 8552b24b45a146a50142b02272141437f8d2f75f..b6ce7e0f8a9b75fff17b2b12b59fd21f5ff8eebe 100644 (file)
--- a/drivers/scsi/lpfc/lpfc_els.c
+++ b/drivers/scsi/lpfc/lpfc_els.c
@@ -1413,11 +1413,12 @@ lpfc_issue_els_flogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
                                phba->defer_flogi_acc.ox_id;
                }
 
-               lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS,
-                                "3354 Xmit deferred FLOGI ACC: rx_id: x%x,"
-                                " ox_id: x%x, hba_flag x%lx\n",
-                                phba->defer_flogi_acc.rx_id,
-                                phba->defer_flogi_acc.ox_id, phba->hba_flag);
+               /* The LS_ACC completion needs to drop the initial reference.
+                * This is a special case for Pt2Pt because both FLOGIs need
+                * to complete and lpfc defers the LS_ACC when the remote
+                * FLOGI arrives before the driver's FLOGI.
+                */
+               set_bit(NLP_FLOGI_DFR_ACC, &ndlp->nlp_flag);
 
                /* Send deferred FLOGI ACC */
                lpfc_els_rsp_acc(vport, ELS_CMD_FLOGI, &defer_flogi_acc,
@@ -1433,6 +1434,14 @@ lpfc_issue_els_flogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
                        phba->defer_flogi_acc.ndlp = NULL;
                }
 
+               lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS,
+                                "3354 Xmit deferred FLOGI ACC: rx_id: x%x,"
+                                " ox_id: x%x, ndlp x%px hba_flag x%lx\n",
+                                phba->defer_flogi_acc.rx_id,
+                                phba->defer_flogi_acc.ox_id,
+                                phba->defer_flogi_acc.ndlp,
+                                phba->hba_flag);
+
                vport->fc_myDID = did;
        }
 
@@ -5302,11 +5311,12 @@ lpfc_cmpl_els_rsp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
        IOCB_t  *irsp;
        LPFC_MBOXQ_t *mbox = NULL;
        u32 ulp_status, ulp_word4, tmo, did, iotag;
+       u32 cmd;
 
        if (!vport) {
                lpfc_printf_log(phba, KERN_WARNING, LOG_ELS,
                                "3177 null vport in ELS rsp\n");
-               goto out;
+               goto release;
        }
        if (cmdiocb->context_un.mbox)
                mbox = cmdiocb->context_un.mbox;
@@ -5416,7 +5426,7 @@ out:
         * these conditions because it doesn't need the login.
         */
        if (phba->sli_rev == LPFC_SLI_REV4 &&
-           vport && vport->port_type == LPFC_NPIV_PORT &&
+           vport->port_type == LPFC_NPIV_PORT &&
            !(ndlp->fc4_xpt_flags & SCSI_XPT_REGD)) {
                if (ndlp->nlp_state != NLP_STE_PLOGI_ISSUE &&
                    ndlp->nlp_state != NLP_STE_REG_LOGIN_ISSUE &&
@@ -5432,6 +5442,27 @@ out:
                }
        }
 
+       /* The driver's unsolicited deferred FLOGI ACC in Pt2Pt needs to
+        * release the initial reference because the put after the free_iocb
+        * call removes only the reference from the defer logic. This FLOGI
+        * is never registered with the SCSI transport.
+        */
+       if (test_bit(FC_PT2PT, &vport->fc_flag) &&
+           test_and_clear_bit(NLP_FLOGI_DFR_ACC, &ndlp->nlp_flag)) {
+               lpfc_printf_vlog(vport, KERN_INFO,
+                                LOG_ELS | LOG_NODE | LOG_DISCOVERY,
+                                "3357 Pt2Pt Defer FLOGI ACC ndlp x%px, "
+                                "nflags x%lx, fc_flag x%lx\n",
+                                ndlp, ndlp->nlp_flag,
+                                vport->fc_flag);
+               cmd = *((u32 *)cmdiocb->cmd_dmabuf->virt);
+               if (cmd == ELS_CMD_ACC) {
+                       if (!test_and_set_bit(NLP_DROPPED, &ndlp->nlp_flag))
+                               lpfc_nlp_put(ndlp);
+               }
+       }
+
+release:
        /* Release the originating I/O reference. */
        lpfc_els_free_iocb(phba, cmdiocb);
        lpfc_nlp_put(ndlp);
@@ -8399,13 +8430,6 @@ lpfc_els_rcv_flogi(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb,
                                                     &wqe->xmit_els_rsp.wqe_com);
 
                vport->fc_myDID = did;
-
-               lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS,
-                                "3344 Deferring FLOGI ACC: rx_id: x%x,"
-                                " ox_id: x%x, hba_flag x%lx\n",
-                                phba->defer_flogi_acc.rx_id,
-                                phba->defer_flogi_acc.ox_id, phba->hba_flag);
-
                phba->defer_flogi_acc.flag = true;
 
                /* This nlp_get is paired with nlp_puts that reset the
@@ -8414,6 +8438,14 @@ lpfc_els_rcv_flogi(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb,
                 * processed or cancelled.
                 */
                phba->defer_flogi_acc.ndlp = lpfc_nlp_get(ndlp);
+
+               lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS,
+                                "3344 Deferring FLOGI ACC: rx_id: x%x,"
+                                " ox_id: x%x, ndlp x%px, hba_flag x%lx\n",
+                                phba->defer_flogi_acc.rx_id,
+                                phba->defer_flogi_acc.ox_id,
+                                phba->defer_flogi_acc.ndlp,
+                                phba->hba_flag);
                return 0;
        }
 
@@ -10354,11 +10386,8 @@ lpfc_els_unsol_buffer(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
         * Do not process any unsolicited ELS commands
         * if the ndlp is in DEV_LOSS
         */
-       if (test_bit(NLP_IN_DEV_LOSS, &ndlp->nlp_flag)) {
-               if (newnode)
-                       lpfc_nlp_put(ndlp);
+       if (test_bit(NLP_IN_DEV_LOSS, &ndlp->nlp_flag))
                goto dropit;
-       }
 
        elsiocb->ndlp = lpfc_nlp_get(ndlp);
        if (!elsiocb->ndlp)