All of lore.kernel.org
 help / color / mirror / Atom feed
From: Christoph Hellwig <hch@infradead.org>
To: "Nicholas A. Bellinger" <nab@linux-iscsi.org>
Cc: target-devel <target-devel@vger.kernel.org>,
	linux-scsi <linux-scsi@vger.kernel.org>,
	lkml <linux-kernel@vger.kernel.org>,
	Rob Millner <rlm@daterainc.com>
Subject: Re: [PATCH 3/5] target: Fix early transport_generic_handle_tmr abort scenario
Date: Tue, 7 Feb 2017 14:45:59 -0800	[thread overview]
Message-ID: <20170207224559.GC5274@infradead.org> (raw)
In-Reply-To: <1486473470-15837-4-git-send-email-nab@linux-iscsi.org>

On Tue, Feb 07, 2017 at 01:17:48PM +0000, Nicholas A. Bellinger wrote:
> From: Nicholas Bellinger <nab@linux-iscsi.org>
> 
> This patch fixes a bug where incoming task management requests
> can be explicitly aborted during an active LUN_RESET, but who's
> struct work_struct are canceled in-flight before execution.
> 
> This occurs when core_tmr_drain_tmr_list() invokes cancel_work_sync()
> for the incoming se_tmr_req->task_cmd->work, resulting in cmd->work
> for target_tmr_work() never getting invoked and the aborted TMR
> waiting indefinately within transport_wait_for_tasks().
> 
> To address this case, perform a CMD_T_ABORTED check early in
> transport_generic_handle_tmr(), and invoke the normal path via
> transport_cmd_check_stop_to_fabric() to complete any TMR kthreads
> blocked waiting for CMD_T_STOP in transport_wait_for_tasks().
> 
> Also, move the TRANSPORT_ISTATE_PROCESSING assignment earlier
> into transport_generic_handle_tmr() so the existing check in
> core_tmr_drain_tmr_list() avoids attempting abort the incoming
> se_tmr_req->task_cmd->work if it has already been queued into
> se_device->tmr_wq.
> 
> Reported-by: Rob Millner <rlm@daterainc.com>
> Tested-by: Rob Millner <rlm@daterainc.com>
> Cc: Rob Millner <rlm@daterainc.com>
> Cc: stable@vger.kernel.org # 3.14+
> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
> ---
>  drivers/target/target_core_transport.c | 17 +++++++++++++++--
>  1 file changed, 15 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
> index 1cadc9e..8b69843 100644
> --- a/drivers/target/target_core_transport.c
> +++ b/drivers/target/target_core_transport.c
> @@ -3110,7 +3110,6 @@ static void target_tmr_work(struct work_struct *work)
>  		spin_unlock_irqrestore(&cmd->t_state_lock, flags);
>  		goto check_stop;
>  	}
> -	cmd->t_state = TRANSPORT_ISTATE_PROCESSING;
>  	spin_unlock_irqrestore(&cmd->t_state_lock, flags);
>  
>  	cmd->se_tfo->queue_tm_rsp(cmd);
> @@ -3123,11 +3122,25 @@ int transport_generic_handle_tmr(
>  	struct se_cmd *cmd)
>  {
>  	unsigned long flags;
> +	bool aborted = false;
>  
>  	spin_lock_irqsave(&cmd->t_state_lock, flags);
> -	cmd->transport_state |= CMD_T_ACTIVE;
> +	if (cmd->transport_state & CMD_T_ABORTED) {
> +		aborted = true;
> +	} else {
> +		cmd->t_state = TRANSPORT_ISTATE_PROCESSING;
> +		cmd->transport_state |= CMD_T_ACTIVE;
> +	}
>  	spin_unlock_irqrestore(&cmd->t_state_lock, flags);
>  
> +	if (aborted) {
> +		pr_warn_ratelimited("handle_tmr caught CMD_T_ABORTED TMR %d"
> +			"ref_tag: %llu tag: %llu\n", cmd->se_tmr_req->function,
> +			cmd->se_tmr_req->ref_task_tag, cmd->tag);

This seems pretty noisy for something that could happen during normal
operation.  Otherwise:

Reviewed-by: Christoph Hellwig <hch@lst.de>

  reply	other threads:[~2017-02-07 22:46 UTC|newest]

Thread overview: 15+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-02-07 13:17 [PATCH 0/5] target: Miscellaneous bug-fixes for >= v4.10 Nicholas A. Bellinger
2017-02-07 13:17 ` [PATCH 1/5] target: Don't BUG_ON during NodeACL dynamic -> explicit conversion Nicholas A. Bellinger
2017-02-07 22:44   ` Christoph Hellwig
2017-02-08 16:16     ` Nicholas A. Bellinger
2017-02-07 13:17 ` [PATCH 2/5] target: Use correct SCSI status during EXTENDED_COPY exception Nicholas A. Bellinger
2017-02-07 22:39   ` Christoph Hellwig
2017-02-07 13:17 ` [PATCH 3/5] target: Fix early transport_generic_handle_tmr abort scenario Nicholas A. Bellinger
2017-02-07 22:45   ` Christoph Hellwig [this message]
2017-02-07 13:17 ` [PATCH 4/5] target: Fix multi-session dynamic se_node_acl double free OOPs Nicholas A. Bellinger
2017-02-07 23:07   ` Christoph Hellwig
2017-02-07 23:12     ` Christoph Hellwig
2017-02-08  3:46       ` Nicholas A. Bellinger
2017-02-08 16:14         ` Nicholas A. Bellinger
2017-02-07 13:17 ` [PATCH 5/5] target: Fix COMPARE_AND_WRITE ref leak for non GOOD status Nicholas A. Bellinger
2017-02-07 22:51   ` Christoph Hellwig

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20170207224559.GC5274@infradead.org \
    --to=hch@infradead.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-scsi@vger.kernel.org \
    --cc=nab@linux-iscsi.org \
    --cc=rlm@daterainc.com \
    --cc=target-devel@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.