[PATCH V3] scsi: core: put LLD module refcnt after SCSI device is released

[PATCH V3] scsi: core: put LLD module refcnt after SCSI device is released

[Ming Lei]

SCSI host release is triggered when SCSI device is freed, and we have to
make sure that LLD module won't be unloaded before SCSI host instance is
released because shost->hostt is required in host release handler.

So make sure to put LLD module refcnt after SCSI device is released.

Fix one kernel panic of 'BUG: unable to handle page fault for address'
reported by Changhui and Yi.

Reported-by: Changhui Zhong <czhong@redhat.com>
Reported-by: Yi Zhang <yi.zhang@redhat.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ming Lei <ming.lei@redhat.com>
---
 drivers/scsi/scsi.c        |  4 +++-
 drivers/scsi/scsi_sysfs.c  | 12 ++++++++++++
 include/scsi/scsi_device.h |  1 +
 3 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
index b241f9e3885c..291ecc33b1fe 100644
--- a/drivers/scsi/scsi.c
+++ b/drivers/scsi/scsi.c
@@ -553,8 +553,10 @@ EXPORT_SYMBOL(scsi_device_get);
  */
 void scsi_device_put(struct scsi_device *sdev)
 {
-	module_put(sdev->host->hostt->module);
+	struct module *mod = sdev->host->hostt->module;
+
 	put_device(&sdev->sdev_gendev);
+	module_put(mod);
 }
 EXPORT_SYMBOL(scsi_device_put);
 
diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index 86793259e541..9ada26814011 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -449,9 +449,16 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work)
 	struct scsi_vpd *vpd_pg80 = NULL, *vpd_pg83 = NULL;
 	struct scsi_vpd *vpd_pg0 = NULL, *vpd_pg89 = NULL;
 	unsigned long flags;
+	struct module *mod;
+	bool put_mod = false;
 
 	sdev = container_of(work, struct scsi_device, ew.work);
 
+	if (sdev->put_lld_mod_ref) {
+		mod = sdev->host->hostt->module;
+		put_mod = true;
+	}
+
 	scsi_dh_release_device(sdev);
 
 	parent = sdev->sdev_gendev.parent;
@@ -502,11 +509,16 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work)
 
 	if (parent)
 		put_device(parent);
+	if (put_mod)
+		module_put(mod);
 }
 
 static void scsi_device_dev_release(struct device *dev)
 {
 	struct scsi_device *sdp = to_scsi_device(dev);
+
+	sdp->put_lld_mod_ref = try_module_get(sdp->host->hostt->module);
+
 	execute_in_process_context(scsi_device_dev_release_usercontext,
 				   &sdp->ew);
 }
diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h
index 430b73bd02ac..54b46d590e2d 100644
--- a/include/scsi/scsi_device.h
+++ b/include/scsi/scsi_device.h
@@ -206,6 +206,7 @@ struct scsi_device {
 	unsigned rpm_autosuspend:1;	/* Enable runtime autosuspend at device
 					 * creation time */
 	unsigned ignore_media_change:1; /* Ignore MEDIA CHANGE on resume */
+	unsigned put_lld_mod_ref:1;	/* Put LLD module ref in release */
 
 	bool offline_already;		/* Device offline message logged */
 
-- 
2.31.1

Re: [PATCH V3] scsi: core: put LLD module refcnt after SCSI device is released

[Yi Zhang]

Tested-by: Yi Zhang <yi.zhang@redhat.com>

This patch fixed one panic issue which I found on s390x with blktests srp tests.
https://lore.kernel.org/linux-block/CAHj4cs8XNtkzbbiLnFmVu82wYeQpLkVp6_wCtrnbhODay+OP9w@mail.gmail.com/#t

On Thu, Sep 30, 2021 at 8:44 PM Ming Lei <ming.lei@redhat.com> wrote:
>
> SCSI host release is triggered when SCSI device is freed, and we have to
> make sure that LLD module won't be unloaded before SCSI host instance is
> released because shost->hostt is required in host release handler.
>
> So make sure to put LLD module refcnt after SCSI device is released.
>
> Fix one kernel panic of 'BUG: unable to handle page fault for address'
> reported by Changhui and Yi.
>
> Reported-by: Changhui Zhong <czhong@redhat.com>
> Reported-by: Yi Zhang <yi.zhang@redhat.com>
> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Signed-off-by: Ming Lei <ming.lei@redhat.com>
> ---
>  drivers/scsi/scsi.c        |  4 +++-
>  drivers/scsi/scsi_sysfs.c  | 12 ++++++++++++
>  include/scsi/scsi_device.h |  1 +
>  3 files changed, 16 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
> index b241f9e3885c..291ecc33b1fe 100644
> --- a/drivers/scsi/scsi.c
> +++ b/drivers/scsi/scsi.c
> @@ -553,8 +553,10 @@ EXPORT_SYMBOL(scsi_device_get);
>   */
>  void scsi_device_put(struct scsi_device *sdev)
>  {
> -       module_put(sdev->host->hostt->module);
> +       struct module *mod = sdev->host->hostt->module;
> +
>         put_device(&sdev->sdev_gendev);
> +       module_put(mod);
>  }
>  EXPORT_SYMBOL(scsi_device_put);
>
> diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
> index 86793259e541..9ada26814011 100644
> --- a/drivers/scsi/scsi_sysfs.c
> +++ b/drivers/scsi/scsi_sysfs.c
> @@ -449,9 +449,16 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work)
>         struct scsi_vpd *vpd_pg80 = NULL, *vpd_pg83 = NULL;
>         struct scsi_vpd *vpd_pg0 = NULL, *vpd_pg89 = NULL;
>         unsigned long flags;
> +       struct module *mod;
> +       bool put_mod = false;
>
>         sdev = container_of(work, struct scsi_device, ew.work);
>
> +       if (sdev->put_lld_mod_ref) {
> +               mod = sdev->host->hostt->module;
> +               put_mod = true;
> +       }
> +
>         scsi_dh_release_device(sdev);
>
>         parent = sdev->sdev_gendev.parent;
> @@ -502,11 +509,16 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work)
>
>         if (parent)
>                 put_device(parent);
> +       if (put_mod)
> +               module_put(mod);
>  }
>
>  static void scsi_device_dev_release(struct device *dev)
>  {
>         struct scsi_device *sdp = to_scsi_device(dev);
> +
> +       sdp->put_lld_mod_ref = try_module_get(sdp->host->hostt->module);
> +
>         execute_in_process_context(scsi_device_dev_release_usercontext,
>                                    &sdp->ew);
>  }
> diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h
> index 430b73bd02ac..54b46d590e2d 100644
> --- a/include/scsi/scsi_device.h
> +++ b/include/scsi/scsi_device.h
> @@ -206,6 +206,7 @@ struct scsi_device {
>         unsigned rpm_autosuspend:1;     /* Enable runtime autosuspend at device
>                                          * creation time */
>         unsigned ignore_media_change:1; /* Ignore MEDIA CHANGE on resume */
> +       unsigned put_lld_mod_ref:1;     /* Put LLD module ref in release */
>
>         bool offline_already;           /* Device offline message logged */
>
> --
> 2.31.1
>


-- 
Best Regards,
  Yi Zhang

Re: [PATCH V3] scsi: core: put LLD module refcnt after SCSI device is released

[Greg Kroah-Hartman]

On Thu, Sep 30, 2021 at 08:44:15PM +0800, Ming Lei wrote:
> SCSI host release is triggered when SCSI device is freed, and we have to
> make sure that LLD module won't be unloaded before SCSI host instance is
> released because shost->hostt is required in host release handler.
> 
> So make sure to put LLD module refcnt after SCSI device is released.

What is a "LLD"?

> Fix one kernel panic of 'BUG: unable to handle page fault for address'
> reported by Changhui and Yi.
> 
> Reported-by: Changhui Zhong <czhong@redhat.com>
> Reported-by: Yi Zhang <yi.zhang@redhat.com>
> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Signed-off-by: Ming Lei <ming.lei@redhat.com>
> ---
>  drivers/scsi/scsi.c        |  4 +++-
>  drivers/scsi/scsi_sysfs.c  | 12 ++++++++++++
>  include/scsi/scsi_device.h |  1 +
>  3 files changed, 16 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
> index b241f9e3885c..291ecc33b1fe 100644
> --- a/drivers/scsi/scsi.c
> +++ b/drivers/scsi/scsi.c
> @@ -553,8 +553,10 @@ EXPORT_SYMBOL(scsi_device_get);
>   */
>  void scsi_device_put(struct scsi_device *sdev)
>  {
> -	module_put(sdev->host->hostt->module);
> +	struct module *mod = sdev->host->hostt->module;
> +
>  	put_device(&sdev->sdev_gendev);
> +	module_put(mod);
>  }
>  EXPORT_SYMBOL(scsi_device_put);
>  
> diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
> index 86793259e541..9ada26814011 100644
> --- a/drivers/scsi/scsi_sysfs.c
> +++ b/drivers/scsi/scsi_sysfs.c
> @@ -449,9 +449,16 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work)
>  	struct scsi_vpd *vpd_pg80 = NULL, *vpd_pg83 = NULL;
>  	struct scsi_vpd *vpd_pg0 = NULL, *vpd_pg89 = NULL;
>  	unsigned long flags;
> +	struct module *mod;
> +	bool put_mod = false;
>  
>  	sdev = container_of(work, struct scsi_device, ew.work);
>  
> +	if (sdev->put_lld_mod_ref) {

Why do you need this flag at all?

Shouldn't you just always grab/release the module?  Why would you not
want to?

thanks,

greg k-h

Re: [PATCH V3] scsi: core: put LLD module refcnt after SCSI device is released

[Ming Lei]

On Tue, Oct 05, 2021 at 03:35:40PM +0200, Greg Kroah-Hartman wrote:
> On Thu, Sep 30, 2021 at 08:44:15PM +0800, Ming Lei wrote:
> > SCSI host release is triggered when SCSI device is freed, and we have to
> > make sure that LLD module won't be unloaded before SCSI host instance is
> > released because shost->hostt is required in host release handler.
> > 
> > So make sure to put LLD module refcnt after SCSI device is released.
> 
> What is a "LLD"?

Lower level driver, which is used often as one scsi term.

> 
> > Fix one kernel panic of 'BUG: unable to handle page fault for address'
> > reported by Changhui and Yi.
> > 
> > Reported-by: Changhui Zhong <czhong@redhat.com>
> > Reported-by: Yi Zhang <yi.zhang@redhat.com>
> > Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> > Signed-off-by: Ming Lei <ming.lei@redhat.com>
> > ---
> >  drivers/scsi/scsi.c        |  4 +++-
> >  drivers/scsi/scsi_sysfs.c  | 12 ++++++++++++
> >  include/scsi/scsi_device.h |  1 +
> >  3 files changed, 16 insertions(+), 1 deletion(-)
> > 
> > diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
> > index b241f9e3885c..291ecc33b1fe 100644
> > --- a/drivers/scsi/scsi.c
> > +++ b/drivers/scsi/scsi.c
> > @@ -553,8 +553,10 @@ EXPORT_SYMBOL(scsi_device_get);
> >   */
> >  void scsi_device_put(struct scsi_device *sdev)
> >  {
> > -	module_put(sdev->host->hostt->module);
> > +	struct module *mod = sdev->host->hostt->module;
> > +
> >  	put_device(&sdev->sdev_gendev);
> > +	module_put(mod);
> >  }
> >  EXPORT_SYMBOL(scsi_device_put);
> >  
> > diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
> > index 86793259e541..9ada26814011 100644
> > --- a/drivers/scsi/scsi_sysfs.c
> > +++ b/drivers/scsi/scsi_sysfs.c
> > @@ -449,9 +449,16 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work)
> >  	struct scsi_vpd *vpd_pg80 = NULL, *vpd_pg83 = NULL;
> >  	struct scsi_vpd *vpd_pg0 = NULL, *vpd_pg89 = NULL;
> >  	unsigned long flags;
> > +	struct module *mod;
> > +	bool put_mod = false;
> >  
> >  	sdev = container_of(work, struct scsi_device, ew.work);
> >  
> > +	if (sdev->put_lld_mod_ref) {
> 
> Why do you need this flag at all?
> 
> Shouldn't you just always grab/release the module?  Why would you not
> want to?

try_module_get() may fail in scsi_device_dev_release() in case that
unloading is started, then we don't need to put it in
scsi_device_dev_release_usercontext(), so this flag is required.


thanks,
Ming

Re: [PATCH V3] scsi: core: put LLD module refcnt after SCSI device is released

[Greg Kroah-Hartman]

On Thu, Oct 07, 2021 at 03:12:52PM +0800, Ming Lei wrote:
> On Tue, Oct 05, 2021 at 03:35:40PM +0200, Greg Kroah-Hartman wrote:
> > On Thu, Sep 30, 2021 at 08:44:15PM +0800, Ming Lei wrote:
> > > SCSI host release is triggered when SCSI device is freed, and we have to
> > > make sure that LLD module won't be unloaded before SCSI host instance is
> > > released because shost->hostt is required in host release handler.
> > > 
> > > So make sure to put LLD module refcnt after SCSI device is released.
> > 
> > What is a "LLD"?
> 
> Lower level driver, which is used often as one scsi term.
> 
> > 
> > > Fix one kernel panic of 'BUG: unable to handle page fault for address'
> > > reported by Changhui and Yi.
> > > 
> > > Reported-by: Changhui Zhong <czhong@redhat.com>
> > > Reported-by: Yi Zhang <yi.zhang@redhat.com>
> > > Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> > > Signed-off-by: Ming Lei <ming.lei@redhat.com>
> > > ---
> > >  drivers/scsi/scsi.c        |  4 +++-
> > >  drivers/scsi/scsi_sysfs.c  | 12 ++++++++++++
> > >  include/scsi/scsi_device.h |  1 +
> > >  3 files changed, 16 insertions(+), 1 deletion(-)
> > > 
> > > diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
> > > index b241f9e3885c..291ecc33b1fe 100644
> > > --- a/drivers/scsi/scsi.c
> > > +++ b/drivers/scsi/scsi.c
> > > @@ -553,8 +553,10 @@ EXPORT_SYMBOL(scsi_device_get);
> > >   */
> > >  void scsi_device_put(struct scsi_device *sdev)
> > >  {
> > > -	module_put(sdev->host->hostt->module);
> > > +	struct module *mod = sdev->host->hostt->module;
> > > +
> > >  	put_device(&sdev->sdev_gendev);
> > > +	module_put(mod);
> > >  }
> > >  EXPORT_SYMBOL(scsi_device_put);
> > >  
> > > diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
> > > index 86793259e541..9ada26814011 100644
> > > --- a/drivers/scsi/scsi_sysfs.c
> > > +++ b/drivers/scsi/scsi_sysfs.c
> > > @@ -449,9 +449,16 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work)
> > >  	struct scsi_vpd *vpd_pg80 = NULL, *vpd_pg83 = NULL;
> > >  	struct scsi_vpd *vpd_pg0 = NULL, *vpd_pg89 = NULL;
> > >  	unsigned long flags;
> > > +	struct module *mod;
> > > +	bool put_mod = false;
> > >  
> > >  	sdev = container_of(work, struct scsi_device, ew.work);
> > >  
> > > +	if (sdev->put_lld_mod_ref) {
> > 
> > Why do you need this flag at all?
> > 
> > Shouldn't you just always grab/release the module?  Why would you not
> > want to?
> 
> try_module_get() may fail in scsi_device_dev_release() in case that
> unloading is started, then we don't need to put it in
> scsi_device_dev_release_usercontext(), so this flag is required.

If grabing the module reference failed then you CAN NOT call into it so
you have a problem here that you seem to be papering over.  Just set the
module pointer to NULL and then you don't need to test it when calling
module_put, right?

thanks,

greg k-h

Re: [PATCH V3] scsi: core: put LLD module refcnt after SCSI device is released

[Ming Lei]

On Thu, Oct 07, 2021 at 09:19:25AM +0200, Greg Kroah-Hartman wrote:
> On Thu, Oct 07, 2021 at 03:12:52PM +0800, Ming Lei wrote:
> > On Tue, Oct 05, 2021 at 03:35:40PM +0200, Greg Kroah-Hartman wrote:
> > > On Thu, Sep 30, 2021 at 08:44:15PM +0800, Ming Lei wrote:
> > > > SCSI host release is triggered when SCSI device is freed, and we have to
> > > > make sure that LLD module won't be unloaded before SCSI host instance is
> > > > released because shost->hostt is required in host release handler.
> > > > 
> > > > So make sure to put LLD module refcnt after SCSI device is released.
> > > 
> > > What is a "LLD"?
> > 
> > Lower level driver, which is used often as one scsi term.
> > 
> > > 
> > > > Fix one kernel panic of 'BUG: unable to handle page fault for address'
> > > > reported by Changhui and Yi.
> > > > 
> > > > Reported-by: Changhui Zhong <czhong@redhat.com>
> > > > Reported-by: Yi Zhang <yi.zhang@redhat.com>
> > > > Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> > > > Signed-off-by: Ming Lei <ming.lei@redhat.com>
> > > > ---
> > > >  drivers/scsi/scsi.c        |  4 +++-
> > > >  drivers/scsi/scsi_sysfs.c  | 12 ++++++++++++
> > > >  include/scsi/scsi_device.h |  1 +
> > > >  3 files changed, 16 insertions(+), 1 deletion(-)
> > > > 
> > > > diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
> > > > index b241f9e3885c..291ecc33b1fe 100644
> > > > --- a/drivers/scsi/scsi.c
> > > > +++ b/drivers/scsi/scsi.c
> > > > @@ -553,8 +553,10 @@ EXPORT_SYMBOL(scsi_device_get);
> > > >   */
> > > >  void scsi_device_put(struct scsi_device *sdev)
> > > >  {
> > > > -	module_put(sdev->host->hostt->module);
> > > > +	struct module *mod = sdev->host->hostt->module;
> > > > +
> > > >  	put_device(&sdev->sdev_gendev);
> > > > +	module_put(mod);
> > > >  }
> > > >  EXPORT_SYMBOL(scsi_device_put);
> > > >  
> > > > diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
> > > > index 86793259e541..9ada26814011 100644
> > > > --- a/drivers/scsi/scsi_sysfs.c
> > > > +++ b/drivers/scsi/scsi_sysfs.c
> > > > @@ -449,9 +449,16 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work)
> > > >  	struct scsi_vpd *vpd_pg80 = NULL, *vpd_pg83 = NULL;
> > > >  	struct scsi_vpd *vpd_pg0 = NULL, *vpd_pg89 = NULL;
> > > >  	unsigned long flags;
> > > > +	struct module *mod;
> > > > +	bool put_mod = false;
> > > >  
> > > >  	sdev = container_of(work, struct scsi_device, ew.work);
> > > >  
> > > > +	if (sdev->put_lld_mod_ref) {
> > > 
> > > Why do you need this flag at all?
> > > 
> > > Shouldn't you just always grab/release the module?  Why would you not
> > > want to?
> > 
> > try_module_get() may fail in scsi_device_dev_release() in case that
> > unloading is started, then we don't need to put it in
> > scsi_device_dev_release_usercontext(), so this flag is required.
> 
> If grabing the module reference failed then you CAN NOT call into it so
> you have a problem here that you seem to be papering over.  Just set the
> module pointer to NULL and then you don't need to test it when calling
> module_put, right?

OK, sounds good, given the failure means that we shouldn't touch it any
more.


Thanks,
Ming