[PATCH] nvme: fix deadlock caused by ana update wrong locking

[PATCH] nvme: fix deadlock caused by ana update wrong locking

[Sagi Grimberg]

The deadlock combines 4 flows in parallel:
- ns scanning (triggered from reconnect)
- request timeout
- ANA update (triggered from reconnect)
- I/O coming into the mpath device

(1) ns scanning triggers disk revalidation -> update disk info ->
    freeze queue -> but blocked, due to (2)

(2) timeout handler reference the g_usage_counter - > but blocks in
    the transport .timeout() handler, due to (3)

(3) the transport timeout handler (indirectly) calls nvme_stop_queue() ->
    which takes the (down_read) namespaces_rwsem - > but blocks, due to (4)

(4) ANA update takes the (down_write) namespaces_rwsem -> calls
    nvme_mpath_set_live() -> which synchronize the ns_head srcu
    (see commit 504db087aacc) -> but blocks, due to (5)

(5) I/O came into nvme_mpath_make_request -> took srcu_read_lock ->
    direct_make_request > blk_queue_enter -> but blocked, due to (1)

==> the request queue is under freeze -> deadlock.

The fix is making ANA update take a read lock as the namespaces list
is not manipulated, it is just the ns and ns->head (which is protected
with the ns->head lock.

Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
---
 drivers/nvme/host/multipath.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
index 61bf87592570..54603bd3e02d 100644
--- a/drivers/nvme/host/multipath.c
+++ b/drivers/nvme/host/multipath.c
@@ -510,7 +510,7 @@ static int nvme_update_ana_state(struct nvme_ctrl *ctrl,
 	if (!nr_nsids)
 		return 0;
 
-	down_write(&ctrl->namespaces_rwsem);
+	down_read(&ctrl->namespaces_rwsem);
 	list_for_each_entry(ns, &ctrl->namespaces, list) {
 		unsigned nsid = le32_to_cpu(desc->nsids[n]);
 
@@ -521,7 +521,7 @@ static int nvme_update_ana_state(struct nvme_ctrl *ctrl,
 		if (++n == nr_nsids)
 			break;
 	}
-	up_write(&ctrl->namespaces_rwsem);
+	up_read(&ctrl->namespaces_rwsem);
 	return 0;
 }
 
-- 
2.20.1


_______________________________________________
linux-nvme mailing list
linux-nvme@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-nvme

Re: [PATCH] nvme: fix deadlock caused by ana update wrong locking

[Keith Busch]

On Thu, Apr 02, 2020 at 09:18:13AM -0700, Sagi Grimberg wrote:
> The deadlock combines 4 flows in parallel:
> - ns scanning (triggered from reconnect)
> - request timeout
> - ANA update (triggered from reconnect)
> - I/O coming into the mpath device
> 
> (1) ns scanning triggers disk revalidation -> update disk info ->
>     freeze queue -> but blocked, due to (2)
> 
> (2) timeout handler reference the g_usage_counter - > but blocks in
>     the transport .timeout() handler, due to (3)
> 
> (3) the transport timeout handler (indirectly) calls nvme_stop_queue() ->
>     which takes the (down_read) namespaces_rwsem - > but blocks, due to (4)
> 
> (4) ANA update takes the (down_write) namespaces_rwsem -> calls
>     nvme_mpath_set_live() -> which synchronize the ns_head srcu
>     (see commit 504db087aacc) -> but blocks, due to (5)
> 
> (5) I/O came into nvme_mpath_make_request -> took srcu_read_lock ->
>     direct_make_request > blk_queue_enter -> but blocked, due to (1)
> 
> ==> the request queue is under freeze -> deadlock.
> 
> The fix is making ANA update take a read lock as the namespaces list
> is not manipulated, it is just the ns and ns->head (which is protected
> with the ns->head lock.
> 
> Signed-off-by: Sagi Grimberg <sagi@grimberg.me>

Patch looks good to me,

Reviewed-by: Keith Busch <kbusch@kernel.org>

I think this could be a stable candidate, so may want to include a fixes
tag:

  Fixes: 0d0b660f214dc ("nvme: add ANA support")

> ---
>  drivers/nvme/host/multipath.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
> index 61bf87592570..54603bd3e02d 100644
> --- a/drivers/nvme/host/multipath.c
> +++ b/drivers/nvme/host/multipath.c
> @@ -510,7 +510,7 @@ static int nvme_update_ana_state(struct nvme_ctrl *ctrl,
>  	if (!nr_nsids)
>  		return 0;
>  
> -	down_write(&ctrl->namespaces_rwsem);
> +	down_read(&ctrl->namespaces_rwsem);
>  	list_for_each_entry(ns, &ctrl->namespaces, list) {
>  		unsigned nsid = le32_to_cpu(desc->nsids[n]);
>  
> @@ -521,7 +521,7 @@ static int nvme_update_ana_state(struct nvme_ctrl *ctrl,
>  		if (++n == nr_nsids)
>  			break;
>  	}
> -	up_write(&ctrl->namespaces_rwsem);
> +	up_read(&ctrl->namespaces_rwsem);
>  	return 0;
>  }

_______________________________________________
linux-nvme mailing list
linux-nvme@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-nvme

Re: [PATCH] nvme: fix deadlock caused by ana update wrong locking

[Hannes Reinecke]

On 4/2/20 6:18 PM, Sagi Grimberg wrote:
> The deadlock combines 4 flows in parallel:
> - ns scanning (triggered from reconnect)
> - request timeout
> - ANA update (triggered from reconnect)
> - I/O coming into the mpath device
> 
> (1) ns scanning triggers disk revalidation -> update disk info ->
>      freeze queue -> but blocked, due to (2)
> 
> (2) timeout handler reference the g_usage_counter - > but blocks in
>      the transport .timeout() handler, due to (3)
> 
> (3) the transport timeout handler (indirectly) calls nvme_stop_queue() ->
>      which takes the (down_read) namespaces_rwsem - > but blocks, due to (4)
> 
> (4) ANA update takes the (down_write) namespaces_rwsem -> calls
>      nvme_mpath_set_live() -> which synchronize the ns_head srcu
>      (see commit 504db087aacc) -> but blocks, due to (5)
> 
> (5) I/O came into nvme_mpath_make_request -> took srcu_read_lock ->
>      direct_make_request > blk_queue_enter -> but blocked, due to (1)
> 
> ==> the request queue is under freeze -> deadlock.
> 
> The fix is making ANA update take a read lock as the namespaces list
> is not manipulated, it is just the ns and ns->head (which is protected
> with the ns->head lock.
> 
> Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
> ---
>   drivers/nvme/host/multipath.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
> index 61bf87592570..54603bd3e02d 100644
> --- a/drivers/nvme/host/multipath.c
> +++ b/drivers/nvme/host/multipath.c
> @@ -510,7 +510,7 @@ static int nvme_update_ana_state(struct nvme_ctrl *ctrl,
>   	if (!nr_nsids)
>   		return 0;
>   
> -	down_write(&ctrl->namespaces_rwsem);
> +	down_read(&ctrl->namespaces_rwsem);
>   	list_for_each_entry(ns, &ctrl->namespaces, list) {
>   		unsigned nsid = le32_to_cpu(desc->nsids[n]);
>   
> @@ -521,7 +521,7 @@ static int nvme_update_ana_state(struct nvme_ctrl *ctrl,
>   		if (++n == nr_nsids)
>   			break;
>   	}
> -	up_write(&ctrl->namespaces_rwsem);
> +	up_read(&ctrl->namespaces_rwsem);
>   	return 0;
>   }
>   
> 
Reviewed-by: Hannes Reinecke <hare@suse.de>

Cheers,

Hannes
-- 
Dr. Hannes Reinecke            Teamlead Storage & Networking
hare@suse.de                               +49 911 74053 688
SUSE Software Solutions GmbH, Maxfeldstr. 5, 90409 Nürnberg
HRB 36809 (AG Nürnberg), Geschäftsführer: Felix Imendörffer

_______________________________________________
linux-nvme mailing list
linux-nvme@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-nvme