From: James Bottomley <James.Bottomley@HansenPartnership.com>
To: Chanho Min <chanho0207@gmail.com>
Cc: Mike Christie <michaelc@cs.wisc.edu>,
linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org,
Jens Axboe <axboe@kernel.dk>, Tejun Heo <tj@kernel.org>,
Bart Van Assche <bvanassche@acm.org>,
Jens Axboe <axboe@kernel.dk>
Subject: Re: [PATCH RESEND] remove the queue unlock in scsi_requset_fn
Date: Thu, 16 Aug 2012 08:56:18 +0100 [thread overview]
Message-ID: <1345103778.3259.12.camel@dabdike.int.hansenpartnership.com> (raw)
In-Reply-To: <CAOAMb1COJbAF=ys7ZcpTuJNP6QzbQzuqz7gS4qPqSc1rfbnHTw@mail.gmail.com>
On Thu, 2012-08-16 at 10:35 +0900, Chanho Min wrote:
> > functions will occur in line. I also don't see why the sdev reference
> > couldn't drop to zero here.
> scsi_request_fn is called under the lock of request_queue->queue_lock.
> If we drop the sdev reference to zero here,
> scsi_device_dev_release_usercontext is
> invoked and make request_queue to NULL. When caller of scsi_request_fn try to
> unlock request_queue->queue_lock, the oops is occurred.
I don't understand this explanation.
sdev->request_queue goes to NULL if the sdev refcount goes to zero (and
blk. We have a copy though in the q variable, which is what we unlock.
That q variable only goes invalid if the queue ref count goes to zero.
If that happens, the queue release function will try to take the lock to
free the elevator and your patch will cause a deadlock.
There are only two possibilities here:
1. The queue refcount can never reach zero within a request
function because block ensures that it can unlock the queue lock
on exit. We could then remove this lock drop and acquire on the
grounds that it is superfluous.
2. The queue refcount does indeed go to zero and the queue gets
released. This would mean that all our lock; request_fn; unlock
patterns do a use after free (in the block layer). Your
proposed patch doesn't fix this (and indeed would cause a
deadlock on the release path).
I've cc'd Jens, because I don't entirely see why our
lock; request_fn; unlock
is safe against a racing blk_cleanup_queue().
James
prev parent reply other threads:[~2012-08-16 7:56 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-08-10 3:22 [PATCH][SCSI] remove the queue unlock in scsi_requset_fn Chanho Min
2012-08-13 17:47 ` Bart Van Assche
2012-08-14 9:48 ` [PATCH RESEND] " Chanho Min
2012-08-14 12:07 ` James Bottomley
2012-08-16 1:35 ` Chanho Min
2012-08-16 7:52 ` Bart Van Assche
2012-08-16 8:10 ` James Bottomley
2012-08-18 11:56 ` Bart Van Assche
2012-08-16 7:56 ` James Bottomley [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1345103778.3259.12.camel@dabdike.int.hansenpartnership.com \
--to=james.bottomley@hansenpartnership.com \
--cc=axboe@kernel.dk \
--cc=bvanassche@acm.org \
--cc=chanho0207@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-scsi@vger.kernel.org \
--cc=michaelc@cs.wisc.edu \
--cc=tj@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).