From: Sasha Levin <sashal@kernel.org>
To: stable@vger.kernel.org, linux-kernel@vger.kernel.org
Cc: "Ewan D. Milne" <emilne@redhat.com>,
"Martin K . Petersen" <martin.petersen@oracle.com>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH AUTOSEL 4.4 29/65] scsi: Add STARGET_CREATED_REMOVE state to scsi_target_state
Date: Thu, 25 Oct 2018 10:16:29 -0400 [thread overview]
Message-ID: <20181025141705.213937-29-sashal@kernel.org> (raw)
In-Reply-To: <20181025141705.213937-1-sashal@kernel.org>
From: "Ewan D. Milne" <emilne@redhat.com>
[ Upstream commit f9279c968c257ee39b0d7bd2571a4d231a67bcc1 ]
The addition of the STARGET_REMOVE state had the side effect of
introducing a race condition that can cause a crash.
scsi_target_reap_ref_release() checks the starget->state to
see if it still in STARGET_CREATED, and if so, skips calling
transport_remove_device() and device_del(), because the starget->state
is only set to STARGET_RUNNING after scsi_target_add() has called
device_add() and transport_add_device().
However, if an rport loss occurs while a target is being scanned,
it can happen that scsi_remove_target() will be called while the
starget is still in the STARGET_CREATED state. In this case, the
starget->state will be set to STARGET_REMOVE, and as a result,
scsi_target_reap_ref_release() will take the wrong path. The end
result is a panic:
[ 1255.356653] Oops: 0000 [#1] SMP
[ 1255.360154] Modules linked in: x86_pkg_temp_thermal kvm_intel kvm irqbypass crc32c_intel ghash_clmulni_i
[ 1255.393234] CPU: 5 PID: 149 Comm: kworker/u96:4 Tainted: G W 4.11.0+ #8
[ 1255.401879] Hardware name: Dell Inc. PowerEdge R320/08VT7V, BIOS 2.0.22 11/19/2013
[ 1255.410327] Workqueue: scsi_wq_6 fc_scsi_scan_rport [scsi_transport_fc]
[ 1255.417720] task: ffff88060ca8c8c0 task.stack: ffffc900048a8000
[ 1255.424331] RIP: 0010:kernfs_find_ns+0x13/0xc0
[ 1255.429287] RSP: 0018:ffffc900048abbf0 EFLAGS: 00010246
[ 1255.435123] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 1255.443083] RDX: 0000000000000000 RSI: ffffffff8188d659 RDI: 0000000000000000
[ 1255.451043] RBP: ffffc900048abc10 R08: 0000000000000000 R09: 0000012433fe0025
[ 1255.459005] R10: 0000000025e5a4b5 R11: 0000000025e5a4b5 R12: ffffffff8188d659
[ 1255.466972] R13: 0000000000000000 R14: ffff8805f55e5088 R15: 0000000000000000
[ 1255.474931] FS: 0000000000000000(0000) GS:ffff880616b40000(0000) knlGS:0000000000000000
[ 1255.483959] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1255.490370] CR2: 0000000000000068 CR3: 0000000001c09000 CR4: 00000000000406e0
[ 1255.498332] Call Trace:
[ 1255.501058] kernfs_find_and_get_ns+0x31/0x60
[ 1255.505916] sysfs_unmerge_group+0x1d/0x60
[ 1255.510498] dpm_sysfs_remove+0x22/0x60
[ 1255.514783] device_del+0xf4/0x2e0
[ 1255.518577] ? device_remove_file+0x19/0x20
[ 1255.523241] attribute_container_class_device_del+0x1a/0x20
[ 1255.529457] transport_remove_classdev+0x4e/0x60
[ 1255.534607] ? transport_add_class_device+0x40/0x40
[ 1255.540046] attribute_container_device_trigger+0xb0/0xc0
[ 1255.546069] transport_remove_device+0x15/0x20
[ 1255.551025] scsi_target_reap_ref_release+0x25/0x40
[ 1255.556467] scsi_target_reap+0x2e/0x40
[ 1255.560744] __scsi_scan_target+0xaa/0x5b0
[ 1255.565312] scsi_scan_target+0xec/0x100
[ 1255.569689] fc_scsi_scan_rport+0xb1/0xc0 [scsi_transport_fc]
[ 1255.576099] process_one_work+0x14b/0x390
[ 1255.580569] worker_thread+0x4b/0x390
[ 1255.584651] kthread+0x109/0x140
[ 1255.588251] ? rescuer_thread+0x330/0x330
[ 1255.592730] ? kthread_park+0x60/0x60
[ 1255.596815] ret_from_fork+0x29/0x40
[ 1255.600801] Code: 24 08 48 83 42 40 01 5b 41 5c 5d c3 66 66 66 2e 0f 1f 84 00 00 00 00 00 66 66 66 66 90
[ 1255.621876] RIP: kernfs_find_ns+0x13/0xc0 RSP: ffffc900048abbf0
[ 1255.628479] CR2: 0000000000000068
[ 1255.632756] ---[ end trace 34a69ba0477d036f ]---
Fix this by adding another scsi_target state STARGET_CREATED_REMOVE
to distinguish this case.
Fixes: f05795d3d771 ("scsi: Add intermediate STARGET_REMOVE state to scsi_target_state")
Reported-by: David Jeffery <djeffery@redhat.com>
Signed-off-by: Ewan D. Milne <emilne@redhat.com>
Cc: <stable@vger.kernel.org>
Reviewed-by: Laurence Oberman <loberman@redhat.com>
Tested-by: Laurence Oberman <loberman@redhat.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/scsi_scan.c | 5 +++--
drivers/scsi/scsi_sysfs.c | 8 ++++++--
include/scsi/scsi_device.h | 1 +
3 files changed, 10 insertions(+), 4 deletions(-)
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index 692445bcca6f..850ddc5fac04 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -381,11 +381,12 @@ static void scsi_target_reap_ref_release(struct kref *kref)
= container_of(kref, struct scsi_target, reap_ref);
/*
- * if we get here and the target is still in the CREATED state that
+ * if we get here and the target is still in a CREATED state that
* means it was allocated but never made visible (because a scan
* turned up no LUNs), so don't call device_del() on it.
*/
- if (starget->state != STARGET_CREATED) {
+ if ((starget->state != STARGET_CREATED) &&
+ (starget->state != STARGET_CREATED_REMOVE)) {
transport_remove_device(&starget->dev);
device_del(&starget->dev);
}
diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index 8db0c48943d6..085e470d1c49 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -1212,11 +1212,15 @@ void scsi_remove_target(struct device *dev)
spin_lock_irqsave(shost->host_lock, flags);
list_for_each_entry(starget, &shost->__targets, siblings) {
if (starget->state == STARGET_DEL ||
- starget->state == STARGET_REMOVE)
+ starget->state == STARGET_REMOVE ||
+ starget->state == STARGET_CREATED_REMOVE)
continue;
if (starget->dev.parent == dev || &starget->dev == dev) {
kref_get(&starget->reap_ref);
- starget->state = STARGET_REMOVE;
+ if (starget->state == STARGET_CREATED)
+ starget->state = STARGET_CREATED_REMOVE;
+ else
+ starget->state = STARGET_REMOVE;
spin_unlock_irqrestore(shost->host_lock, flags);
__scsi_remove_target(starget);
scsi_target_reap(starget);
diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h
index 293b9a7f53bc..fb53a94a5e8b 100644
--- a/include/scsi/scsi_device.h
+++ b/include/scsi/scsi_device.h
@@ -240,6 +240,7 @@ enum scsi_target_state {
STARGET_CREATED = 1,
STARGET_RUNNING,
STARGET_REMOVE,
+ STARGET_CREATED_REMOVE,
STARGET_DEL,
};
--
2.17.1
next prev parent reply other threads:[~2018-10-25 14:17 UTC|newest]
Thread overview: 70+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-10-25 14:16 [PATCH AUTOSEL 4.4 01/65] KEYS: put keyring if install_session_keyring_to_cred() fails Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 02/65] ipv6: suppress sparse warnings in IP6_ECN_set_ce() Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 03/65] net: drop write-only stack variable Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 04/65] ser_gigaset: use container_of() instead of detour Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 05/65] tracing: Skip more functions when doing stack tracing of events Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 06/65] ARM: dts: apq8064: add ahci ports-implemented mask Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 07/65] x86/mm/pat: Prevent hang during boot when mapping pages Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 08/65] btrfs: cleaner_kthread() doesn't need explicit freeze Sasha Levin
2018-10-25 15:07 ` David Sterba
2018-10-25 20:07 ` Sasha Levin
2018-10-26 6:58 ` Jiri Kosina
2018-10-26 10:57 ` Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 09/65] radix-tree: fix radix_tree_iter_retry() for tagged iterators Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 10/65] af_iucv: Move sockaddr length checks to before accessing sa_family in bind and connect handlers Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 11/65] net/mlx4_en: Resolve dividing by zero in 32-bit system Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 12/65] ipv6: orphan skbs in reassembly unit Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 13/65] um: Avoid longjmp/setjmp symbol clashes with libpthread.a Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 14/65] sched/cgroup: Fix cgroup entity load tracking tear-down Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 15/65] btrfs: don't create or leak aliased root while cleaning up orphans Sasha Levin
2018-10-25 15:12 ` David Sterba
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 16/65] thermal: allow spear-thermal driver to be a module Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 17/65] thermal: allow u8500-thermal " Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 18/65] tpm: fix: return rc when devm_add_action() fails Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 19/65] x86/PCI: Mark Broadwell-EP Home Agent 1 as having non-compliant BARs Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 20/65] aacraid: Start adapter after updating number of MSIX vectors Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 21/65] perf/core: Don't leak event in the syscall error path Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 22/65] [media] usbvision: revert commit 588afcc1 Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 23/65] MIPS: Fix FCSR Cause bit handling for correct SIGFPE issue Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 24/65] ASoC: ak4613: Enable cache usage to fix crashes on resume Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 25/65] ASoC: wm8940: " Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 26/65] CIFS: handle guest access errors to Windows shares Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 27/65] arm64: Fix potential race with hardware DBM in ptep_set_access_flags() Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 28/65] xfrm: Clear sk_dst_cache when applying per-socket policy Sasha Levin
2018-10-25 14:16 ` Sasha Levin [this message]
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 30/65] sparc/pci: Refactor dev_archdata initialization into pci_init_dev_archdata Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 31/65] sch_red: update backlog as well Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 32/65] usb-storage: fix bogus hardware error messages for ATA pass-thru devices Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 33/65] bpf: generally move prog destruction to RCU deferral Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 34/65] drm/nouveau/fbcon: fix oops without fbdev emulation Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 35/65] fuse: Dont call set_page_dirty_lock() for ITER_BVEC pages for async_dio Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 36/65] ixgbevf: Fix handling of NAPI budget when multiple queues are enabled per vector Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 37/65] net/mlx5e: Fix LRO modify Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 38/65] net/mlx5e: Correctly handle RSS indirection table when changing number of channels Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 39/65] ixgbe: fix RSS limit for X550 Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 40/65] ixgbe: Correct X550EM_x revision check Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 41/65] ALSA: timer: Fix zero-division by continue of uninitialized instance Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 42/65] vti6: flush x-netns xfrm cache when vti interface is removed Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 43/65] gro: Allow tunnel stacking in the case of FOU/GUE Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 44/65] brcmfmac: Fix glom_skb leak in brcmf_sdiod_recv_chain Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 45/65] l2tp: hold socket before dropping lock in l2tp_ip{, 6}_recv() Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 46/65] tty: serial: sprd: fix error return code in sprd_probe() Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 47/65] video: fbdev: pxa3xx_gcu: fix error return code in pxa3xx_gcu_probe() Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 48/65] sparc64 mm: Fix more TSB sizing issues Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 49/65] gpu: host1x: fix error return code in host1x_probe() Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 50/65] sparc64: Fix exception handling in UltraSPARC-III memcpy Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 51/65] gpio: msic: fix error return code in platform_msic_gpio_probe() Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 52/65] usb: imx21-hcd: fix error return code in imx21_probe() Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 53/65] usb: ehci-omap: fix error return code in ehci_hcd_omap_probe() Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 54/65] usb: dwc3: omap: fix error return code in dwc3_omap_probe() Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 55/65] spi/bcm63xx-hspi: fix error return code in bcm63xx_hsspi_probe() Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 56/65] MIPS: Handle non word sized instructions when examining frame Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 57/65] spi/bcm63xx: fix error return code in bcm63xx_spi_probe() Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 58/65] spi: xlp: fix error return code in xlp_spi_probe() Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 59/65] ASoC: spear: fix error return code in spdif_in_probe() Sasha Levin
2018-10-25 14:17 ` [PATCH AUTOSEL 4.4 60/65] PM / devfreq: tegra: fix error return code in tegra_devfreq_probe() Sasha Levin
2018-10-25 14:17 ` [PATCH AUTOSEL 4.4 61/65] bonding: avoid defaulting hard_header_len to ETH_HLEN on slave removal Sasha Levin
2018-10-25 14:17 ` [PATCH AUTOSEL 4.4 62/65] scsi: aacraid: Fix typo in blink status Sasha Levin
2018-10-25 14:17 ` [PATCH AUTOSEL 4.4 63/65] MIPS: microMIPS: Fix decoding of swsp16 instruction Sasha Levin
2018-10-25 14:17 ` [PATCH AUTOSEL 4.4 64/65] igb: Remove superfluous reset to PHY and page 0 selection Sasha Levin
2018-10-25 14:17 ` [PATCH AUTOSEL 4.4 65/65] MIPS: DEC: Fix an int-handler.S CPU_DADDI_WORKAROUNDS regression Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181025141705.213937-29-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=emilne@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=martin.petersen@oracle.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).