All of lore.kernel.org
 help / color / mirror / Atom feed
From: Dmitry Bogdanov <d.bogdanov@yadro.com>
To: Mike Christie <michael.christie@oracle.com>
Cc: <mlombard@redhat.com>, <martin.petersen@oracle.com>,
	<mgurtovoy@nvidia.com>, <sagi@grimberg.me>,
	<linux-scsi@vger.kernel.org>, <target-devel@vger.kernel.org>
Subject: Re: [PATCH v3 07/14] scsi: target: Fix multiple LUN_RESET handling
Date: Sat, 11 Feb 2023 11:59:22 +0300	[thread overview]
Message-ID: <20230211085922.GA5419@yadro.com> (raw)
In-Reply-To: <20230129234441.116310-8-michael.christie@oracle.com>

On Sun, Jan 29, 2023 at 05:44:34PM -0600, Mike Christie wrote:
> 
> This fixes a bug where an initiator thinks a LUN_RESET has cleaned
> up running commands when it hasn't. The bug was added in:
> 
> commit 51ec502a3266 ("target: Delete tmr from list before processing")
> 
> The problem occurs when:
> 
> 1. We have N IO cmds running in the target layer spread over 2 sessions.
> 2. The initiator sends a LUN_RESET for each session.
> 3. session1's LUN_RESET loops over all the running commands from both
> sessions and moves them to its local drain_task_list.
> 4. session2's LUN_RESET does not see the LUN_RESET from session1 because
> the commit above has it remove itself. session2 also does not see any
> commands since the other reset moved them off the state lists.
> 5. sessions2's LUN_RESET will then complete with a successful response.
> 6. sessions2's inititor believes the running commands on its session are
> now cleaned up due to the successful response and cleans up the running
> commands from its side. It then restarts them.
> 7. The commands do eventually complete on the backend and the target
> starts to return aborted task statuses for them. The initiator will
> either throw a invalid ITT error or might accidentally lookup a new task
> if the ITT has been reallocated already.
> 
> This fixes the bug by reverting the patch.
> 
> Fixes: 51ec502a3266 ("target: Delete tmr from list before processing")
> Signed-off-by: Mike Christie <michael.christie@oracle.com>
> Reviewed-by: Dmitry Bogdanov <d.bogdanov@yadro.com>

Actually, this patch even fixes a crash that we've just faced.
The second LUN_RESET moves the first LUN_RESET from tmr_list to its
drain_tmr_list, then the first LUN_RESET removes itself from second`s
drain_tmr_list, then the second LUN_RESET tries to remove the first from
the list and crashes because it was deleted already.
So,

Tested-by: Dmitry Bogdanov <d.bogdanov@yadro.com>


  reply	other threads:[~2023-02-11  9:01 UTC|newest]

Thread overview: 26+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-01-29 23:44 [PATCH v3 00/14] target: TMF and recovery fixes Mike Christie
2023-01-29 23:44 ` [PATCH v3 01/14] scsi: target: Move sess cmd counter to new struct Mike Christie
2023-03-07 10:53   ` Maurizio Lombardi
2023-01-29 23:44 ` [PATCH v3 02/14] scsi: target: Move cmd counter allocation Mike Christie
2023-01-29 23:44 ` [PATCH v3 03/14] scsi: target: Pass in cmd counter to use during cmd setup Mike Christie
2023-01-29 23:44 ` [PATCH v3 04/14] scsi: target: iscsit/isert: Alloc per conn cmd counter Mike Christie
2023-01-29 23:44 ` [PATCH v3 05/14] scsi: target: iscsit: stop/wait on cmds during conn close Mike Christie
2023-03-01 11:57   ` Maurizio Lombardi
2023-01-29 23:44 ` [PATCH v3 06/14] scsi: target: iscsit: Fix TAS handling during conn cleanup Mike Christie
2023-02-14 14:12   ` Maurizio Lombardi
2023-01-29 23:44 ` [PATCH v3 07/14] scsi: target: Fix multiple LUN_RESET handling Mike Christie
2023-02-11  8:59   ` Dmitry Bogdanov [this message]
2023-03-02  9:43     ` Dmitry Bogdanov
2023-03-02 17:29       ` Mike Christie
2023-03-03  9:26         ` Dmitry Bogdanov
2023-03-03 16:52           ` Mike Christie
2023-01-29 23:44 ` [PATCH v3 08/14] scsi: target: Drop t_state_lock use in compare_and_write_post Mike Christie
2023-01-29 23:44 ` [PATCH v3 09/14] scsi: target: Treat CMD_T_FABRIC_STOP like CMD_T_STOP Mike Christie
2023-01-29 23:44 ` [PATCH v3 10/14] scsi: target: iscsit: Add helper to check when cmd has failed Mike Christie
2023-02-27 15:12   ` Maurizio Lombardi
2023-01-29 23:44 ` [PATCH v3 11/14] scsi: target: iscsit: Cleanup isert commands at conn closure Mike Christie
2023-01-29 23:44 ` [PATCH v3 12/14] IB/isert: Fix hang in target_wait_for_cmds Mike Christie
2023-01-29 23:44 ` [PATCH v3 13/14] IB/isert: Fix use after free during conn cleanup Mike Christie
2023-02-27 15:10   ` Maurizio Lombardi
2023-01-29 23:44 ` [PATCH v3 14/14] scsi: target: iscsit: free cmds before session free Mike Christie
2023-02-22 12:26   ` Maurizio Lombardi

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20230211085922.GA5419@yadro.com \
    --to=d.bogdanov@yadro.com \
    --cc=linux-scsi@vger.kernel.org \
    --cc=martin.petersen@oracle.com \
    --cc=mgurtovoy@nvidia.com \
    --cc=michael.christie@oracle.com \
    --cc=mlombard@redhat.com \
    --cc=sagi@grimberg.me \
    --cc=target-devel@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.