From: Bart Van Assche <Bart.VanAssche@wdc.com>
To: "linux-scsi@vger.kernel.org" <linux-scsi@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "sreekanth.reddy@broadcom.com" <sreekanth.reddy@broadcom.com>
CC: "hch@infradead.org" <hch@infradead.org>,
        "jejb@kernel.org" <jejb@kernel.org>,
        "martin.petersen@oracle.com" <martin.petersen@oracle.com>
Subject: Re: mpt3sas: driver got task abort request just after it's
 .shutdown() function is invoked
Thread-Topic: mpt3sas: driver got task abort request just after it's
 .shutdown() function is invoked
Thread-Index: AQHS5Nqik0dXyM5K6EiUzymywFR0JqIka6qA
Date: Wed, 14 Jun 2017 14:29:55 +0000
Message-ID: <1497450593.3896.2.camel@wdc.com>
References: <CAK=zhgqfFhLcpZGYrsBRjCiFRwz_8sf=hEt+Jd1aJEvMd8x61Q@mail.gmail.com>
In-Reply-To: <CAK=zhgqfFhLcpZGYrsBRjCiFRwz_8sf=hEt+Jd1aJEvMd8x61Q@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
wdcipoutbound: EOP-TRUE
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: text/plain; charset="utf-8"
Content-ID: <CA966D05342FF44C91BED484BAC122EC@namprd04.prod.outlook.com>
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-originalarrivaltime: 14 Jun 2017 14:29:56.0015
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: b61c8803-16f3-4c35-9b17-6f65f441df86
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY1PR0401MB1536
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from base64 to 8bit by mail.home.local id v5EEUipW015994
Content-Length: 1553
Lines: 33

On Wed, 2017-06-14 at 12:20 +0530, Sreekanth Reddy wrote:
> I am using 4.9 kernel and I am observing NULL pointer deference type
> kernel panic in the below scenario,
> 
> * Hotplug (i.e. hot add) the HBA (with a set of drives attached to it)
> to the system just few seconds before issuing "poweroff" command.
> 
> * Observed that during drives discovery process; for some of the
> drives "MODE SENSE" command got timed out.
> 
> * And as "poweroff" command issued, so kernel as called driver's
> shutdown() callback function and driver has cleaned up all the HBA
> resources (such as IRQ's, memory pools etc).
> 
> * But as the "MODE SENSE" command got timed out, so SCSI EH thread has
> invoked driver's .eh_abort_handler() callback function, but by this
> time driver has already cleaned up the resources and so it leads to
> kernel panic when it trying to access one of these resources.
> 
> I was assuming that kernel should not call driver's shutdown()
> callback function until all the outstanding IOs count reaches to zero
> (i.e. kernel should call the driver's shutdown() functions only after
> clearing up all the outstanding IOs). Please correct me if I am wrong,
> and please suggest better way to handle these types of issues.

Hello Sreekanth,

The SCSI core is not aware of PCIe (hot-)removal and hence cannot help
in this case. I think SCSI LLDs are responsible when .shutdown() is
called for 1) waiting until any ongoing scsi_scan_target() call has
finished and 2) calling scsi_remove_host() from inside pci_driver.shutdown().

Bart.