From: Maurizio Lombardi <mlombard@redhat.com>
To: Lv Yunlong <lyl2019@mail.ustc.edu.cn>, martin.petersen@oracle.com
Cc: linux-scsi@vger.kernel.org, target-devel@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH] target: Fix a double put in transport_free_session
Date: Fri, 26 Mar 2021 13:31:39 +0100 [thread overview]
Message-ID: <f03c8a67-d015-d503-726b-647b4f327b25@redhat.com> (raw)
In-Reply-To: <20210323025851.11782-1-lyl2019@mail.ustc.edu.cn>
Dne 23. 03. 21 v 3:58 Lv Yunlong napsal(a):
> In transport_free_session, se_nacl is got from se_sess
> with the initial reference. If se_nacl->acl_sess_list is
> empty, se_nacl->dynamic_stop is set to true. Then the first
> target_put_nacl(se_nacl) will drop the initial reference
> and free se_nacl. Later there is a second target_put_nacl()
> to put se_nacl. It may cause error in race.
>
> My patch sets se_nacl->dynamic_stop to false to avoid the
> double put.
>
> Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
> ---
> drivers/target/target_core_transport.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
> index 5ecb9f18a53d..c266defe694f 100644
> --- a/drivers/target/target_core_transport.c
> +++ b/drivers/target/target_core_transport.c
> @@ -584,8 +584,10 @@ void transport_free_session(struct se_session *se_sess)
> }
> mutex_unlock(&se_tpg->acl_node_mutex);
>
> - if (se_nacl->dynamic_stop)
> + if (se_nacl->dynamic_stop) {
> target_put_nacl(se_nacl);
> + se_nacl->dynamic_stop = false;
> + }
>
> target_put_nacl(se_nacl);
> }
>
FYI,
I have received a bug report against the 5.8 kernel about task hangs that seems to involve the nacl "dynamic_stop" code
Mar 4 16:49:44 gzboot kernel: [186322.177819] INFO: task targetcli:2359053 blocked for more than 120 seconds.
Mar 4 16:49:44 gzboot kernel: [186322.178862] Tainted: P O 5.8.0-44-generic #50-Ubuntu
Mar 4 16:49:44 gzboot kernel: [186322.179746] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
Mar 4 16:49:44 gzboot kernel: [186322.180583] targetcli D 0 2359053 2359052 0x00000000
Mar 4 16:49:44 gzboot kernel: [186322.180586] Call Trace:
Mar 4 16:49:44 gzboot kernel: [186322.180592] __schedule+0x212/0x5d0
Mar 4 16:49:44 gzboot kernel: [186322.180595] ? usleep_range+0x90/0x90
Mar 4 16:49:44 gzboot kernel: [186322.180596] schedule+0x55/0xc0
Mar 4 16:49:44 gzboot kernel: [186322.180597] schedule_timeout+0x10f/0x160
Mar 4 16:49:44 gzboot kernel: [186322.180601] ? evict+0x14c/0x1b0
Mar 4 16:49:44 gzboot kernel: [186322.180602] __wait_for_common+0xa8/0x150
Mar 4 16:49:44 gzboot kernel: [186322.180603] wait_for_completion+0x24/0x30
Mar 4 16:49:44 gzboot kernel: [186322.180637] core_tpg_del_initiator_node_acl+0x8e/0x120 [target_core_mod]
Mar 4 16:49:44 gzboot kernel: [186322.180643] target_fabric_nacl_base_release+0x26/0x30 [target_core_mod]
Mar 4 16:49:44 gzboot kernel: [186322.180647] config_item_cleanup+0x5d/0xf0
Mar 4 16:49:44 gzboot kernel: [186322.180649] config_item_put+0x2d/0x40
Mar 4 16:49:44 gzboot kernel: [186322.180651] configfs_rmdir+0x1d8/0x350
Mar 4 16:49:44 gzboot kernel: [186322.180653] vfs_rmdir.part.0+0x66/0x190
Mar 4 16:49:44 gzboot kernel: [186322.180654] do_rmdir+0x1b4/0x200
Mar 4 16:49:44 gzboot kernel: [186322.180655] __x64_sys_rmdir+0x17/0x20
Mar 4 16:49:44 gzboot kernel: [186322.180657] do_syscall_64+0x49/0xc0
Mar 4 16:49:44 gzboot kernel: [186322.180659] entry_SYSCALL_64_after_hwframe+0x44/0xa9
Mar 4 16:49:44 gzboot kernel: [186322.180660] RIP: 0033:0x7f30cf1ca9eb
Mar 4 16:49:44 gzboot kernel: [186322.180661] RSP: 002b:00007ffd72030bd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
Mar 4 16:49:44 gzboot kernel: [186322.180662] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00007f30cf1ca9eb
Mar 4 16:49:44 gzboot kernel: [186322.180663] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007f30cc1e2a50
Mar 4 16:49:44 gzboot kernel: [186322.180664] RBP: 0000000000a4b7a0 R08: 0000000000000000 R09: 00007ffd72030b7f
Mar 4 16:49:44 gzboot kernel: [186322.180664] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd72030c00
Mar 4 16:49:44 gzboot kernel: [186322.180665] R13: 00007f30cdd706a8 R14: 00007f30ced00cc0 R15: 00007f30cdd70698
Maurizio
next prev parent reply other threads:[~2021-03-26 12:32 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-23 2:58 [PATCH] target: Fix a double put in transport_free_session Lv Yunlong
2021-03-23 16:28 ` michael.christie
2021-03-25 7:48 ` lyl2019
2021-03-25 17:24 ` Mike Christie
2021-03-26 11:11 ` lyl2019
2021-03-26 12:31 ` Maurizio Lombardi [this message]
2021-03-26 16:24 ` Mike Christie
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=f03c8a67-d015-d503-726b-647b4f327b25@redhat.com \
--to=mlombard@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-scsi@vger.kernel.org \
--cc=lyl2019@mail.ustc.edu.cn \
--cc=martin.petersen@oracle.com \
--cc=target-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).