[resend with linux-scsi@ in Cc, my apologies]
This is a follow up to "scsi: Add intermediate STARGET_REMOVE state to
scsi_target_state".
If anyone has an idea how to create a regression test suite for the target
removal path I'd be all ears, given the fact that this is the 3rd or 4th patch
targeting it.
Changes to v1:
* Fix error (hit BUG_ON()) discovered by the 0-Day bot.
* Revert "scsi: fix soft lockup in scsi_remove_target() on module removal"
Johannes Thumshirn (2):
Revert "scsi: fix soft lockup in scsi_remove_target() on module
removal"
scsi: Add intermediate STARGET_REMOVE state to scsi_target_state
drivers/scsi/scsi_scan.c | 2 ++
drivers/scsi/scsi_sysfs.c | 6 +++---
include/scsi/scsi_device.h | 1 +
3 files changed, 6 insertions(+), 3 deletions(-)
--
1.8.5.6
Add intermediate STARGET_REMOVE state to scsi_target_state to avoid running
into the BUG_ON() in scsi_target_reap().
This intermediate state is only valid in the path from scsi_remove_target() to
scsi_target_destroy() indicating this target is going to be removed.
Signed-off-by: Johannes Thumshirn <[email protected]>
Fixes: 40998193560dab6c3ce8d25f4fa58a23e252ef38
Cc: [email protected]
Reviewed-by: Hannes Reinecke <[email protected]>
Reviewed-by: Ewan D. Milne <[email protected]>
---
Changes from v1:
* The state transition from STARGET_CREATED to STARGET_DEL is legitimate,
so don't BUG() on it. Found by the 0-Day Bot.
drivers/scsi/scsi_scan.c | 2 ++
drivers/scsi/scsi_sysfs.c | 4 +++-
include/scsi/scsi_device.h | 1 +
3 files changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index 6a82066..63b8bca 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -315,6 +315,8 @@ static void scsi_target_destroy(struct scsi_target *starget)
struct Scsi_Host *shost = dev_to_shost(dev->parent);
unsigned long flags;
+ BUG_ON(starget->state != STARGET_REMOVE &&
+ starget->state != STARGET_CREATED);
starget->state = STARGET_DEL;
transport_destroy_device(dev);
spin_lock_irqsave(shost->host_lock, flags);
diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index 4f18a85..9e5f893 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -1278,10 +1278,12 @@ void scsi_remove_target(struct device *dev)
restart:
spin_lock_irqsave(shost->host_lock, flags);
list_for_each_entry(starget, &shost->__targets, siblings) {
- if (starget->state == STARGET_DEL)
+ if (starget->state == STARGET_DEL ||
+ starget->state == STARGET_REMOVE)
continue;
if (starget->dev.parent == dev || &starget->dev == dev) {
kref_get(&starget->reap_ref);
+ starget->state = STARGET_REMOVE;
spin_unlock_irqrestore(shost->host_lock, flags);
__scsi_remove_target(starget);
scsi_target_reap(starget);
diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h
index f63a167..2bffaa6 100644
--- a/include/scsi/scsi_device.h
+++ b/include/scsi/scsi_device.h
@@ -240,6 +240,7 @@ scmd_printk(const char *, const struct scsi_cmnd *, const char *, ...);
enum scsi_target_state {
STARGET_CREATED = 1,
STARGET_RUNNING,
+ STARGET_REMOVE,
STARGET_DEL,
};
--
1.8.5.6
This reverts commit 90a88d6ef88edcfc4f644dddc7eef4ea41bccf8b.
Signed-off-by: Johannes Thumshirn <[email protected]>
Cc: [email protected]
---
drivers/scsi/scsi_sysfs.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index 00bc721..4f18a85 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -1272,18 +1272,16 @@ static void __scsi_remove_target(struct scsi_target *starget)
void scsi_remove_target(struct device *dev)
{
struct Scsi_Host *shost = dev_to_shost(dev->parent);
- struct scsi_target *starget, *last_target = NULL;
+ struct scsi_target *starget;
unsigned long flags;
restart:
spin_lock_irqsave(shost->host_lock, flags);
list_for_each_entry(starget, &shost->__targets, siblings) {
- if (starget->state == STARGET_DEL ||
- starget == last_target)
+ if (starget->state == STARGET_DEL)
continue;
if (starget->dev.parent == dev || &starget->dev == dev) {
kref_get(&starget->reap_ref);
- last_target = starget;
spin_unlock_irqrestore(shost->host_lock, flags);
__scsi_remove_target(starget);
scsi_target_reap(starget);
--
1.8.5.6
On Wed, 2016-03-30 at 09:09 +0200, Johannes Thumshirn wrote:
> This reverts commit 90a88d6ef88edcfc4f644dddc7eef4ea41bccf8b.
>
> Signed-off-by: Johannes Thumshirn <[email protected]>
> Cc: [email protected]
> ---
> drivers/scsi/scsi_sysfs.c | 6 ++----
> 1 file changed, 2 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
> index 00bc721..4f18a85 100644
> --- a/drivers/scsi/scsi_sysfs.c
> +++ b/drivers/scsi/scsi_sysfs.c
> @@ -1272,18 +1272,16 @@ static void __scsi_remove_target(struct scsi_target *starget)
> void scsi_remove_target(struct device *dev)
> {
> struct Scsi_Host *shost = dev_to_shost(dev->parent);
> - struct scsi_target *starget, *last_target = NULL;
> + struct scsi_target *starget;
> unsigned long flags;
>
> restart:
> spin_lock_irqsave(shost->host_lock, flags);
> list_for_each_entry(starget, &shost->__targets, siblings) {
> - if (starget->state == STARGET_DEL ||
> - starget == last_target)
> + if (starget->state == STARGET_DEL)
> continue;
> if (starget->dev.parent == dev || &starget->dev == dev) {
> kref_get(&starget->reap_ref);
> - last_target = starget;
> spin_unlock_irqrestore(shost->host_lock, flags);
> __scsi_remove_target(starget);
> scsi_target_reap(starget);
Reviewed-by: Ewan D. Milne <[email protected]>
On Wed, 2016-03-30 at 09:09 +0200, Johannes Thumshirn wrote:
> Add intermediate STARGET_REMOVE state to scsi_target_state to avoid running
> into the BUG_ON() in scsi_target_reap().
>
> This intermediate state is only valid in the path from scsi_remove_target() to
> scsi_target_destroy() indicating this target is going to be removed.
>
> Signed-off-by: Johannes Thumshirn <[email protected]>
> Fixes: 40998193560dab6c3ce8d25f4fa58a23e252ef38
> Cc: [email protected]
> Reviewed-by: Hannes Reinecke <[email protected]>
> Reviewed-by: Ewan D. Milne <[email protected]>
> ---
>
> Changes from v1:
> * The state transition from STARGET_CREATED to STARGET_DEL is legitimate,
> so don't BUG() on it. Found by the 0-Day Bot.
>
>
> drivers/scsi/scsi_scan.c | 2 ++
> drivers/scsi/scsi_sysfs.c | 4 +++-
> include/scsi/scsi_device.h | 1 +
> 3 files changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
> index 6a82066..63b8bca 100644
> --- a/drivers/scsi/scsi_scan.c
> +++ b/drivers/scsi/scsi_scan.c
> @@ -315,6 +315,8 @@ static void scsi_target_destroy(struct scsi_target *starget)
> struct Scsi_Host *shost = dev_to_shost(dev->parent);
> unsigned long flags;
>
> + BUG_ON(starget->state != STARGET_REMOVE &&
> + starget->state != STARGET_CREATED);
> starget->state = STARGET_DEL;
> transport_destroy_device(dev);
> spin_lock_irqsave(shost->host_lock, flags);
> diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
> index 4f18a85..9e5f893 100644
> --- a/drivers/scsi/scsi_sysfs.c
> +++ b/drivers/scsi/scsi_sysfs.c
> @@ -1278,10 +1278,12 @@ void scsi_remove_target(struct device *dev)
> restart:
> spin_lock_irqsave(shost->host_lock, flags);
> list_for_each_entry(starget, &shost->__targets, siblings) {
> - if (starget->state == STARGET_DEL)
> + if (starget->state == STARGET_DEL ||
> + starget->state == STARGET_REMOVE)
> continue;
> if (starget->dev.parent == dev || &starget->dev == dev) {
> kref_get(&starget->reap_ref);
> + starget->state = STARGET_REMOVE;
> spin_unlock_irqrestore(shost->host_lock, flags);
> __scsi_remove_target(starget);
> scsi_target_reap(starget);
> diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h
> index f63a167..2bffaa6 100644
> --- a/include/scsi/scsi_device.h
> +++ b/include/scsi/scsi_device.h
> @@ -240,6 +240,7 @@ scmd_printk(const char *, const struct scsi_cmnd *, const char *, ...);
> enum scsi_target_state {
> STARGET_CREATED = 1,
> STARGET_RUNNING,
> + STARGET_REMOVE,
> STARGET_DEL,
> };
>
Reviewed-by: Ewan D. Milne <[email protected]>
On Wed, 2016-03-30 at 09:09 +0200, Johannes Thumshirn wrote:
> [resend with linux-scsi@ in Cc, my apologies]
>
> This is a follow up to "scsi: Add intermediate STARGET_REMOVE state
> to scsi_target_state".
>
> If anyone has an idea how to create a regression test suite for the
> target removal path I'd be all ears, given the fact that this is the
> 3rd or 4th patch targeting it.
Actually, could you reverse the order of these patches, please. It's
not safe to revert the soft lockup fix until after the intermediate
state is introduced. I'd rather we didn't go through a point in the
tree where the bug exists again.
Thanks,
James
Johannes Thumshirn wrote:
> Add intermediate STARGET_REMOVE state to scsi_target_state to avoid running
> into the BUG_ON() in scsi_target_reap().
>
> This intermediate state is only valid in the path from scsi_remove_target() to
> scsi_target_destroy() indicating this target is going to be removed.
>
> Signed-off-by: Johannes Thumshirn <[email protected]>
> Fixes: 40998193560dab6c3ce8d25f4fa58a23e252ef38
> Cc: [email protected]
> Reviewed-by: Hannes Reinecke <[email protected]>
> Reviewed-by: Ewan D. Milne <[email protected]>
> ---
>
> Changes from v1:
> * The state transition from STARGET_CREATED to STARGET_DEL is legitimate,
> so don't BUG() on it. Found by the 0-Day Bot.
This is yet another attempt to fix 40998193560d. Can you please explain how
it is "superior" to the one proposed by Bart before [1] ?
[1] http://marc.info/?l=linux-scsi&m=145227191917602&w=2
Sebastian
On 2016-03-30 18:43, James Bottomley wrote:
> On Wed, 2016-03-30 at 09:09 +0200, Johannes Thumshirn wrote:
>> [resend with linux-scsi@ in Cc, my apologies]
>>
>> This is a follow up to "scsi: Add intermediate STARGET_REMOVE state
>> to scsi_target_state".
>>
>> If anyone has an idea how to create a regression test suite for the
>> target removal path I'd be all ears, given the fact that this is the
>> 3rd or 4th patch targeting it.
>
> Actually, could you reverse the order of these patches, please. It's
> not safe to revert the soft lockup fix until after the intermediate
> state is introduced. I'd rather we didn't go through a point in the
> tree where the bug exists again.
You're right. I'll resend the series in reverse order.
Hi Sebastian,
On 2016-03-30 23:44, Sebastian Herbszt wrote:
> Johannes Thumshirn wrote:
>> Add intermediate STARGET_REMOVE state to scsi_target_state to avoid
>> running
>> into the BUG_ON() in scsi_target_reap().
>>
>> This intermediate state is only valid in the path from
>> scsi_remove_target() to
>> scsi_target_destroy() indicating this target is going to be removed.
>>
>> Signed-off-by: Johannes Thumshirn <[email protected]>
>> Fixes: 40998193560dab6c3ce8d25f4fa58a23e252ef38
>> Cc: [email protected]
>> Reviewed-by: Hannes Reinecke <[email protected]>
>> Reviewed-by: Ewan D. Milne <[email protected]>
>> ---
>>
>> Changes from v1:
>> * The state transition from STARGET_CREATED to STARGET_DEL is
>> legitimate,
>> so don't BUG() on it. Found by the 0-Day Bot.
>
> This is yet another attempt to fix 40998193560d. Can you please explain
> how
> it is "superior" to the one proposed by Bart before [1] ?
>
> [1] http://marc.info/?l=linux-scsi&m=145227191917602&w=2
First of all I didn't oppose Bart's patch.
But let me try explaining mine (in contrast to Bart's).
The patch above expands the current SCSI target state machine, whereas
Bart's patch removed the target state machine and tied the target states
to their sysfs representaion, like his patch description explains
[quote]
Instead of representing the states "visible in sysfs" and
"has been removed from the target list" by a single state
variable, use two variables to represent this information.
[/quote]
It is actually the other way round to my patch. The above expands the
target state machine from (simplified)
CREATED -> RUNNING -> DEL
\_____________^
to:
CREATED -> RUNNING -> REMOVE -> DEL
\_______________________^
This intermediate step ensures that scsi_target_reap() is not called
with a target in the STARGET_DEL state (which causes the BUG_ON() to
trigger).
As said above, both patches do the same (eliminate the race in the
target removal path) but differently.
I hope I could answer your questions.
Byte,
Johannes