[RESEND PATCH v2 0/2] Update SCSI target removal path

[RESEND PATCH v2 0/2] Update SCSI target removal path

[Johannes Thumshirn]

[resend with linux-scsi@ in Cc, my apologies]

This is a follow up to "scsi: Add intermediate STARGET_REMOVE state to 
scsi_target_state".

If anyone has an idea how to create a regression test suite for the target
removal path I'd be all ears, given the fact that this is the 3rd or 4th patch
targeting it.

Changes to v1:
* Fix error (hit BUG_ON()) discovered by the 0-Day bot.
* Revert "scsi: fix soft lockup in scsi_remove_target() on module removal"

Johannes Thumshirn (2):
  Revert "scsi: fix soft lockup in scsi_remove_target() on module
    removal"
  scsi: Add intermediate STARGET_REMOVE state to scsi_target_state

 drivers/scsi/scsi_scan.c   | 2 ++
 drivers/scsi/scsi_sysfs.c  | 6 +++---
 include/scsi/scsi_device.h | 1 +
 3 files changed, 6 insertions(+), 3 deletions(-)

-- 
1.8.5.6

[RESEND PATCH v2 1/2] Revert "scsi: fix soft lockup in scsi_remove_target() on module removal"

[Johannes Thumshirn]

This reverts commit 90a88d6ef88edcfc4f644dddc7eef4ea41bccf8b.

Signed-off-by: Johannes Thumshirn <jthumshirn@suse.de>
Cc: stable@vger.kernel.org
---
 drivers/scsi/scsi_sysfs.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index 00bc721..4f18a85 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -1272,18 +1272,16 @@ static void __scsi_remove_target(struct scsi_target *starget)
 void scsi_remove_target(struct device *dev)
 {
 	struct Scsi_Host *shost = dev_to_shost(dev->parent);
-	struct scsi_target *starget, *last_target = NULL;
+	struct scsi_target *starget;
 	unsigned long flags;
 
 restart:
 	spin_lock_irqsave(shost->host_lock, flags);
 	list_for_each_entry(starget, &shost->__targets, siblings) {
-		if (starget->state == STARGET_DEL ||
-		    starget == last_target)
+		if (starget->state == STARGET_DEL)
 			continue;
 		if (starget->dev.parent == dev || &starget->dev == dev) {
 			kref_get(&starget->reap_ref);
-			last_target = starget;
 			spin_unlock_irqrestore(shost->host_lock, flags);
 			__scsi_remove_target(starget);
 			scsi_target_reap(starget);
-- 
1.8.5.6

[RESEND PATCH v2 2/2] scsi: Add intermediate STARGET_REMOVE state to scsi_target_state

[Johannes Thumshirn]

Add intermediate STARGET_REMOVE state to scsi_target_state to avoid running
into the BUG_ON() in scsi_target_reap().

This intermediate state is only valid in the path from scsi_remove_target() to
scsi_target_destroy() indicating this target is going to be removed.

Signed-off-by: Johannes Thumshirn <jthumshirn@suse.de>
Fixes: 40998193560dab6c3ce8d25f4fa58a23e252ef38
Cc: stable@vger.kernel.org
Reviewed-by: Hannes Reinecke <hare@suse.com>
Reviewed-by: Ewan D. Milne <emilne@redhat.com>
---

Changes from v1:
* The state transition from STARGET_CREATED to STARGET_DEL is legitimate,
  so don't BUG() on it. Found by the 0-Day Bot.


 drivers/scsi/scsi_scan.c   | 2 ++
 drivers/scsi/scsi_sysfs.c  | 4 +++-
 include/scsi/scsi_device.h | 1 +
 3 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index 6a82066..63b8bca 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -315,6 +315,8 @@ static void scsi_target_destroy(struct scsi_target *starget)
 	struct Scsi_Host *shost = dev_to_shost(dev->parent);
 	unsigned long flags;
 
+	BUG_ON(starget->state != STARGET_REMOVE &&
+	       starget->state != STARGET_CREATED);
 	starget->state = STARGET_DEL;
 	transport_destroy_device(dev);
 	spin_lock_irqsave(shost->host_lock, flags);
diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index 4f18a85..9e5f893 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -1278,10 +1278,12 @@ void scsi_remove_target(struct device *dev)
 restart:
 	spin_lock_irqsave(shost->host_lock, flags);
 	list_for_each_entry(starget, &shost->__targets, siblings) {
-		if (starget->state == STARGET_DEL)
+		if (starget->state == STARGET_DEL ||
+		    starget->state == STARGET_REMOVE)
 			continue;
 		if (starget->dev.parent == dev || &starget->dev == dev) {
 			kref_get(&starget->reap_ref);
+			starget->state = STARGET_REMOVE;
 			spin_unlock_irqrestore(shost->host_lock, flags);
 			__scsi_remove_target(starget);
 			scsi_target_reap(starget);
diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h
index f63a167..2bffaa6 100644
--- a/include/scsi/scsi_device.h
+++ b/include/scsi/scsi_device.h
@@ -240,6 +240,7 @@ scmd_printk(const char *, const struct scsi_cmnd *, const char *, ...);
 enum scsi_target_state {
 	STARGET_CREATED = 1,
 	STARGET_RUNNING,
+	STARGET_REMOVE,
 	STARGET_DEL,
 };
 
-- 
1.8.5.6

Re: [RESEND PATCH v2 1/2] Revert "scsi: fix soft lockup in scsi_remove_target() on module removal"

[Ewan D. Milne]

On Wed, 2016-03-30 at 09:09 +0200, Johannes Thumshirn wrote:
> This reverts commit 90a88d6ef88edcfc4f644dddc7eef4ea41bccf8b.
> 
> Signed-off-by: Johannes Thumshirn <jthumshirn@suse.de>
> Cc: stable@vger.kernel.org
> ---
>  drivers/scsi/scsi_sysfs.c | 6 ++----
>  1 file changed, 2 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
> index 00bc721..4f18a85 100644
> --- a/drivers/scsi/scsi_sysfs.c
> +++ b/drivers/scsi/scsi_sysfs.c
> @@ -1272,18 +1272,16 @@ static void __scsi_remove_target(struct scsi_target *starget)
>  void scsi_remove_target(struct device *dev)
>  {
>  	struct Scsi_Host *shost = dev_to_shost(dev->parent);
> -	struct scsi_target *starget, *last_target = NULL;
> +	struct scsi_target *starget;
>  	unsigned long flags;
>  
>  restart:
>  	spin_lock_irqsave(shost->host_lock, flags);
>  	list_for_each_entry(starget, &shost->__targets, siblings) {
> -		if (starget->state == STARGET_DEL ||
> -		    starget == last_target)
> +		if (starget->state == STARGET_DEL)
>  			continue;
>  		if (starget->dev.parent == dev || &starget->dev == dev) {
>  			kref_get(&starget->reap_ref);
> -			last_target = starget;
>  			spin_unlock_irqrestore(shost->host_lock, flags);
>  			__scsi_remove_target(starget);
>  			scsi_target_reap(starget);

Reviewed-by: Ewan D. Milne <emilne@redhat.com>

Re: [RESEND PATCH v2 2/2] scsi: Add intermediate STARGET_REMOVE state to scsi_target_state

[Ewan D. Milne]

On Wed, 2016-03-30 at 09:09 +0200, Johannes Thumshirn wrote:
> Add intermediate STARGET_REMOVE state to scsi_target_state to avoid running
> into the BUG_ON() in scsi_target_reap().
> 
> This intermediate state is only valid in the path from scsi_remove_target() to
> scsi_target_destroy() indicating this target is going to be removed.
> 
> Signed-off-by: Johannes Thumshirn <jthumshirn@suse.de>
> Fixes: 40998193560dab6c3ce8d25f4fa58a23e252ef38
> Cc: stable@vger.kernel.org
> Reviewed-by: Hannes Reinecke <hare@suse.com>
> Reviewed-by: Ewan D. Milne <emilne@redhat.com>
> ---
> 
> Changes from v1:
> * The state transition from STARGET_CREATED to STARGET_DEL is legitimate,
>   so don't BUG() on it. Found by the 0-Day Bot.
> 
> 
>  drivers/scsi/scsi_scan.c   | 2 ++
>  drivers/scsi/scsi_sysfs.c  | 4 +++-
>  include/scsi/scsi_device.h | 1 +
>  3 files changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
> index 6a82066..63b8bca 100644
> --- a/drivers/scsi/scsi_scan.c
> +++ b/drivers/scsi/scsi_scan.c
> @@ -315,6 +315,8 @@ static void scsi_target_destroy(struct scsi_target *starget)
>  	struct Scsi_Host *shost = dev_to_shost(dev->parent);
>  	unsigned long flags;
>  
> +	BUG_ON(starget->state != STARGET_REMOVE &&
> +	       starget->state != STARGET_CREATED);
>  	starget->state = STARGET_DEL;
>  	transport_destroy_device(dev);
>  	spin_lock_irqsave(shost->host_lock, flags);
> diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
> index 4f18a85..9e5f893 100644
> --- a/drivers/scsi/scsi_sysfs.c
> +++ b/drivers/scsi/scsi_sysfs.c
> @@ -1278,10 +1278,12 @@ void scsi_remove_target(struct device *dev)
>  restart:
>  	spin_lock_irqsave(shost->host_lock, flags);
>  	list_for_each_entry(starget, &shost->__targets, siblings) {
> -		if (starget->state == STARGET_DEL)
> +		if (starget->state == STARGET_DEL ||
> +		    starget->state == STARGET_REMOVE)
>  			continue;
>  		if (starget->dev.parent == dev || &starget->dev == dev) {
>  			kref_get(&starget->reap_ref);
> +			starget->state = STARGET_REMOVE;
>  			spin_unlock_irqrestore(shost->host_lock, flags);
>  			__scsi_remove_target(starget);
>  			scsi_target_reap(starget);
> diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h
> index f63a167..2bffaa6 100644
> --- a/include/scsi/scsi_device.h
> +++ b/include/scsi/scsi_device.h
> @@ -240,6 +240,7 @@ scmd_printk(const char *, const struct scsi_cmnd *, const char *, ...);
>  enum scsi_target_state {
>  	STARGET_CREATED = 1,
>  	STARGET_RUNNING,
> +	STARGET_REMOVE,
>  	STARGET_DEL,
>  };
>  

Reviewed-by: Ewan D. Milne <emilne@redhat.com>

Re: [RESEND PATCH v2 0/2] Update SCSI target removal path

[James Bottomley]

On Wed, 2016-03-30 at 09:09 +0200, Johannes Thumshirn wrote:
> [resend with linux-scsi@ in Cc, my apologies]
> 
> This is a follow up to "scsi: Add intermediate STARGET_REMOVE state 
> to scsi_target_state".
> 
> If anyone has an idea how to create a regression test suite for the 
> target removal path I'd be all ears, given the fact that this is the 
> 3rd or 4th patch targeting it.

Actually, could you reverse the order of these patches, please.  It's
not safe to revert the soft lockup fix until after the intermediate
state is introduced.  I'd rather we didn't go through a point in the
tree where the bug exists again.

Thanks,

James

Re: [RESEND PATCH v2 2/2] scsi: Add intermediate STARGET_REMOVE state to scsi_target_state

[Sebastian Herbszt]

Johannes Thumshirn wrote:
> Add intermediate STARGET_REMOVE state to scsi_target_state to avoid running
> into the BUG_ON() in scsi_target_reap().
> 
> This intermediate state is only valid in the path from scsi_remove_target() to
> scsi_target_destroy() indicating this target is going to be removed.
> 
> Signed-off-by: Johannes Thumshirn <jthumshirn@suse.de>
> Fixes: 40998193560dab6c3ce8d25f4fa58a23e252ef38
> Cc: stable@vger.kernel.org
> Reviewed-by: Hannes Reinecke <hare@suse.com>
> Reviewed-by: Ewan D. Milne <emilne@redhat.com>
> ---
> 
> Changes from v1:
> * The state transition from STARGET_CREATED to STARGET_DEL is legitimate,
>   so don't BUG() on it. Found by the 0-Day Bot.

This is yet another attempt to fix 40998193560d. Can you please explain how
it is "superior" to the one proposed by Bart before [1] ?

[1] http://marc.info/?l=linux-scsi&m=145227191917602&w=2

Sebastian

Re: [RESEND PATCH v2 0/2] Update SCSI target removal path

[jthumshirn]

On 2016-03-30 18:43, James Bottomley wrote:
> On Wed, 2016-03-30 at 09:09 +0200, Johannes Thumshirn wrote:
>> [resend with linux-scsi@ in Cc, my apologies]
>> 
>> This is a follow up to "scsi: Add intermediate STARGET_REMOVE state
>> to scsi_target_state".
>> 
>> If anyone has an idea how to create a regression test suite for the
>> target removal path I'd be all ears, given the fact that this is the
>> 3rd or 4th patch targeting it.
> 
> Actually, could you reverse the order of these patches, please.  It's
> not safe to revert the soft lockup fix until after the intermediate
> state is introduced.  I'd rather we didn't go through a point in the
> tree where the bug exists again.

You're right. I'll resend the series in reverse order.

Re: [RESEND PATCH v2 2/2] scsi: Add intermediate STARGET_REMOVE state to scsi_target_state

[jthumshirn]

Hi Sebastian,

On 2016-03-30 23:44, Sebastian Herbszt wrote:
> Johannes Thumshirn wrote:
>> Add intermediate STARGET_REMOVE state to scsi_target_state to avoid 
>> running
>> into the BUG_ON() in scsi_target_reap().
>> 
>> This intermediate state is only valid in the path from 
>> scsi_remove_target() to
>> scsi_target_destroy() indicating this target is going to be removed.
>> 
>> Signed-off-by: Johannes Thumshirn <jthumshirn@suse.de>
>> Fixes: 40998193560dab6c3ce8d25f4fa58a23e252ef38
>> Cc: stable@vger.kernel.org
>> Reviewed-by: Hannes Reinecke <hare@suse.com>
>> Reviewed-by: Ewan D. Milne <emilne@redhat.com>
>> ---
>> 
>> Changes from v1:
>> * The state transition from STARGET_CREATED to STARGET_DEL is 
>> legitimate,
>>   so don't BUG() on it. Found by the 0-Day Bot.
> 
> This is yet another attempt to fix 40998193560d. Can you please explain 
> how
> it is "superior" to the one proposed by Bart before [1] ?
> 
> [1] http://marc.info/?l=linux-scsi&m=145227191917602&w=2

First of all I didn't oppose Bart's patch.
But let me try explaining mine (in contrast to Bart's).

The patch above expands the current SCSI target state machine, whereas 
Bart's patch removed the target state machine and tied the target states 
to their sysfs representaion, like his patch description explains

[quote]
Instead of representing the states "visible in sysfs" and
"has been removed from the target list" by a single state
variable, use two variables to represent this information.
[/quote]

It is actually the other way round to my patch. The above expands the 
target state machine from (simplified)

CREATED -> RUNNING -> DEL
         \_____________^

to:
CREATED -> RUNNING -> REMOVE -> DEL
         \_______________________^

This intermediate step ensures that scsi_target_reap() is not called 
with a target in the STARGET_DEL state (which causes the BUG_ON() to 
trigger).

As said above, both patches do the same (eliminate the race in the 
target removal path) but differently.

I hope I could answer your questions.

Byte,
     Johannes