[PATCH v2] nvme: remove stale namespaces by NSID range during scan

[Randy Jennings]

On Sat, Aug 22, 2026 at 5:47 PM Mohamed Khalfella
<mkhalfella at purestorage.com> wrote:
>
> nvme_scan_ns_list() drops the stale namespaces in each gap in the
> reported NSID list one NSID at a time. Every iteration calls
> nvme_find_get_ns() to look the namespace up and removes it if it is
> present. The loop runs once per NSID in the gap rather than once per
> namespace actually present.
>
> NSIDs are 32-bit, so a target with a sparse NSID space can make a
> single gap spin the loop billions of times with nothing to remove.
>
>   watchdog: BUG: soft lockup - CPU#4 stuck for 26s!
>   Workqueue: nvme-wq nvme_scan_work [nvme_core]
>   RIP: 0010:__srcu_read_unlock+0xb/0x20
>   Call Trace:
>    nvme_find_get_ns+0x7d/0xb0 [nvme_core]
>    nvme_scan_ns_list+0xe8/0x280 [nvme_core]
>    nvme_scan_work+0x18a/0x280 [nvme_core]
>    process_one_work+0x197/0x380
>    worker_thread+0x2fe/0x410
>    kthread+0xe0/0x100
>
> Rename nvme_remove_invalid_namespaces() to nvme_remove_nsid_range()
> and give it an open (start, end) NSID range. ctrl->namespaces is
> sorted by NSID, so the whole gap is dropped in a single walk that
> stops once end is reached. This bounds the work by the namespaces
> that are present instead of by the size of the gap.
>
> Fixes: 540c801c65eb ("NVMe: Implement namespace list scanning")
> Signed-off-by: Mohamed Khalfella <mkhalfella at purestorage.com>
> Reviewed-by: Sagi Grimberg <sagi at grimberg.me>
Reviewed-by: Randy Jennings <randyj at purestorage.com>

> ---
>  drivers/nvme/host/core.c | 18 +++++++++---------

> -static void nvme_remove_invalid_namespaces(struct nvme_ctrl *ctrl,
> -                                       unsigned nsid)
> +static void nvme_remove_nsid_range(struct nvme_ctrl *ctrl, u32 start, u32 end)
It is not intuitive to me that start is non-inclusive.  May we add
a comment to that effect?

>  {
>         struct nvme_ns *ns, *next;
>         LIST_HEAD(rm_list);
>
>         mutex_lock(&ctrl->namespaces_lock);
>         list_for_each_entry_safe(ns, next, &ctrl->namespaces, list) {
> -               if (ns->head->ns_id > nsid) {
> +               if (ns->head->ns_id >= end)
> +                       break;
> +               if (ns->head->ns_id > start) {
>                         list_del_rcu(&ns->list);