[PATCH] scsi: lpfc: disable delayed CQ work before freeing a queue

[PATCH] scsi: lpfc: disable delayed CQ work before freeing a queue

[Hongyan Xu]

CQ processing can leave sched_irqwork or sched_spwork pending on a
delayed work timer. Flushing the HBA workqueue does not wait for delayed
work whose timer has not yet queued it, allowing lpfc_sli4_queue_free()
to release the embedded work item and its queue first.

Initialize both delayed works before allocation can fail, and disable
them synchronously before freeing any queue resources.

Fixes: 32517fc0975b ("scsi: lpfc: Rework EQ/CQ processing to address interrupt coalescing")
Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
---
 drivers/scsi/lpfc/lpfc_sli.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index cfa4371169f1..0348442b979f 100644
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -15828,6 +15828,9 @@ lpfc_sli4_queue_free(struct lpfc_queue *queue)
 	if (!queue)
 		return;
 
+	disable_delayed_work_sync(&queue->sched_irqwork);
+	disable_delayed_work_sync(&queue->sched_spwork);
+
 	if (!list_empty(&queue->wq_list))
 		list_del(&queue->wq_list);
 
@@ -15892,6 +15895,8 @@ lpfc_sli4_queue_alloc(struct lpfc_hba *phba, uint32_t page_size,
 	INIT_LIST_HEAD(&queue->page_list);
 	INIT_LIST_HEAD(&queue->child_list);
 	INIT_LIST_HEAD(&queue->cpu_list);
+	INIT_DELAYED_WORK(&queue->sched_irqwork, lpfc_sli4_dly_hba_process_cq);
+	INIT_DELAYED_WORK(&queue->sched_spwork, lpfc_sli4_dly_sp_process_cq);
 
 	/* Set queue parameters now.  If the system cannot provide memory
 	 * resources, the free routine needs to know what was allocated.
@@ -15922,8 +15927,6 @@ lpfc_sli4_queue_alloc(struct lpfc_hba *phba, uint32_t page_size,
 	}
 	INIT_WORK(&queue->irqwork, lpfc_sli4_hba_process_cq);
 	INIT_WORK(&queue->spwork, lpfc_sli4_sp_process_cq);
-	INIT_DELAYED_WORK(&queue->sched_irqwork, lpfc_sli4_dly_hba_process_cq);
-	INIT_DELAYED_WORK(&queue->sched_spwork, lpfc_sli4_dly_sp_process_cq);
 
 	/* notify_interval will be set during q creation */
 
-- 
2.50.1.windows.1

Re: [PATCH] scsi: lpfc: disable delayed CQ work before freeing a queue

[Paul Ely]

[-- Attachment #1: Type: text/plain, Size: 2481 bytes --]

Hello Hongyan,

Interesting patch.  How did find this issue?  Testing?  If so, what
sort of test or was it code review/AI?

Thanks

Paul

On Mon, Sep 28, 2026 at 9:42 AM Hongyan Xu <getshell@seu.edu.cn> wrote:
>
> CQ processing can leave sched_irqwork or sched_spwork pending on a
> delayed work timer. Flushing the HBA workqueue does not wait for delayed
> work whose timer has not yet queued it, allowing lpfc_sli4_queue_free()
> to release the embedded work item and its queue first.
>
> Initialize both delayed works before allocation can fail, and disable
> them synchronously before freeing any queue resources.
>
> Fixes: 32517fc0975b ("scsi: lpfc: Rework EQ/CQ processing to address interrupt coalescing")
> Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
> ---
>  drivers/scsi/lpfc/lpfc_sli.c | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
> index cfa4371169f1..0348442b979f 100644
> --- a/drivers/scsi/lpfc/lpfc_sli.c
> +++ b/drivers/scsi/lpfc/lpfc_sli.c
> @@ -15828,6 +15828,9 @@ lpfc_sli4_queue_free(struct lpfc_queue *queue)
>         if (!queue)
>                 return;
>
> +       disable_delayed_work_sync(&queue->sched_irqwork);
> +       disable_delayed_work_sync(&queue->sched_spwork);
> +
>         if (!list_empty(&queue->wq_list))
>                 list_del(&queue->wq_list);
>
> @@ -15892,6 +15895,8 @@ lpfc_sli4_queue_alloc(struct lpfc_hba *phba, uint32_t page_size,
>         INIT_LIST_HEAD(&queue->page_list);
>         INIT_LIST_HEAD(&queue->child_list);
>         INIT_LIST_HEAD(&queue->cpu_list);
> +       INIT_DELAYED_WORK(&queue->sched_irqwork, lpfc_sli4_dly_hba_process_cq);
> +       INIT_DELAYED_WORK(&queue->sched_spwork, lpfc_sli4_dly_sp_process_cq);
>
>         /* Set queue parameters now.  If the system cannot provide memory
>          * resources, the free routine needs to know what was allocated.
> @@ -15922,8 +15927,6 @@ lpfc_sli4_queue_alloc(struct lpfc_hba *phba, uint32_t page_size,
>         }
>         INIT_WORK(&queue->irqwork, lpfc_sli4_hba_process_cq);
>         INIT_WORK(&queue->spwork, lpfc_sli4_sp_process_cq);
> -       INIT_DELAYED_WORK(&queue->sched_irqwork, lpfc_sli4_dly_hba_process_cq);
> -       INIT_DELAYED_WORK(&queue->sched_spwork, lpfc_sli4_dly_sp_process_cq);
>
>         /* notify_interval will be set during q creation */
>
> --
> 2.50.1.windows.1
>

[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 5453 bytes --]