Subject: Re: [PATCH-next v2 2/2] scsi: fix iscsi rescan fails to create block
 device
To:     Greg KH <gregkh@linuxfoundation.org>,
        Zhong Jinghua <zhongjinghua@huawei.com>
Cc:     jejb@linux.ibm.com, martin.petersen@oracle.com, hare@suse.de,
        bvanassche@acm.org, emilne@redhat.com,
        linux-kernel@vger.kernel.org, linux-scsi@vger.kernel.org,
        yi.zhang@huawei.com, "yukuai (C)" <yukuai3@huawei.com>
References: <20230128094146.205858-1-zhongjinghua@huawei.com>
 <20230128094146.205858-3-zhongjinghua@huawei.com>
 <Y9T8uQYEaGUZwpHO@kroah.com>
From:   Yu Kuai <yukuai1@huaweicloud.com>
Message-ID: <b4927ca9-7330-3f32-f68f-1a449473a0ce@huaweicloud.com>
Date:   Sun, 29 Jan 2023 09:13:55 +0800
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101
 Thunderbird/60.8.0
MIME-Version: 1.0
In-Reply-To: <Y9T8uQYEaGUZwpHO@kroah.com>
Content-Type: text/plain; charset=gbk; format=flowed
Content-Transfer-Encoding: 8bit
Precedence: bulk

Hi, Greg

?? 2023/01/28 18:45, Greg KH д??:
>> diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
>> index cac7c902cf70..a22109cdb8ef 100644
>> --- a/drivers/scsi/scsi_sysfs.c
>> +++ b/drivers/scsi/scsi_sysfs.c
>> @@ -1535,9 +1535,7 @@ static void __scsi_remove_target(struct scsi_target *starget)
>>   		if (sdev->channel != starget->channel ||
>>   		    sdev->id != starget->id)
>>   			continue;
>> -		if (sdev->sdev_state == SDEV_DEL ||
>> -		    sdev->sdev_state == SDEV_CANCEL ||
>> -		    !get_device(&sdev->sdev_gendev))
>> +		if (!get_device_unless_zero(&sdev->sdev_gendev))
> 
> If sdev_gendev is 0 here, the object is gone and you are working with
> memory that is already freed so something is _VERY_ wrong.

In fact, this patch will work:

In __scsi_remove_target(), 'host_lock' is held to protect iterating
siblings, and object will wait for this lock in
scsi_device_dev_release() to remove siblings. Hence sdev will not be
freed untill the lock is released.

Thanks,
Kuai
> 
> This isn't ok, sorry.
> 
> greg k-h
> .
>