lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 14 Jun 2018 11:12:01 +0800 From: "jianchao.wang" <jianchao.w.wang@...cle.com> To: Bart Van Assche <Bart.VanAssche@....com>, "hch@....de" <hch@....de> Cc: "randrianasulu@...il.com" <randrianasulu@...il.com>, "rdunlap@...radead.org" <rdunlap@...radead.org>, "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>, "linux-scsi@...r.kernel.org" <linux-scsi@...r.kernel.org>, "linux-block@...r.kernel.org" <linux-block@...r.kernel.org> Subject: Re: kernel BUG at drivers/scsi/scsi_error.c:197! - git 4.17.0-x64-08428-g7d3bf613e99a Hi Christoph and Bart On 06/13/2018 10:08 PM, Bart Van Assche wrote: > On Wed, 2018-06-13 at 16:04 +0200, hch@....de wrote: >>> I suspect this is due to we could expire a same request twice or even more. >>> For scsi mid-layer, it return BLK_EH_DONE from .timeout, in fact, the request is not >>> completed there, but just queue a delayed abort_work (HZ/100). If the blk_mq_timeout_work >>> runs again before the abort_work, the request will be timed out again, because there is not >>> any mark on it to identify this request has been timed out. >>> >>> Would please try the patch attached on to see whether this issue could be fixed ? >>> (this patch only works for scsi device currently) >> >> The patch isn't really going to work without a caller of your new >> __blk_mq_complete_request helper, is it?> > __blk_mq_complete_request() is already called today by blk_mq_complete_request(). > However, it's not clear to me why that function is exported by Jianchao's patch. > Sorry for the confusion about this path. In the current blk-mq timeout mechanism of 4.18, the reference count of request only ensure the request tag will not be release during the timeout handing, this is a great idea to fix the life recycle issue. But we don't protect the timed out request against the normal completion path. For example, if a request is in scsi abort or eh procedure, it still could be completed by the normal completion path. Before this, blk_mq_complete_request cannot proceed to invoke __blk_mq_complete_request if a request is timed out, because we have marked 'completed' or 'aborted_gstate' when we find the request is timed out. In the blk-legacy, we still do this with blk_mark_request_complete in blk_rq_check_expired and blk_complete_request. The patch I posted here is to change the request state to MQ_RQ_COMPLETE if it is timed out, then we could protect the timed out request against the normal request again. But we have handed the task of completing a timed out request to LLDD, and blk_mq_complete_request cannot work any more, so I exported __blk_mq_complete_request here for the time out path of LLDD to complete the request. There is another patch to replace the blk_mq_complete_request to __blk_mq_complete_request, but I did't post here due to this is just a test. For scsi mid-layer, the scsi_mq_done will invoke blk_mq_complete_request, the abort and eh procedure will finally invoke blk_mq_requeue_request and blk_mq_end_request, so the this patch should work for scsi. Thanks Jianchao >> Either way the concept of doing error handling without quiescing the >> queue just looks bogus to me and will end up with some sort of race >> here or there. > > The SCSI error handler already waits until all pending requests have finished > before it starts handling timed out commands. This e-mail thread started with a > report of a crash in the SCSI error handler, which is a regression introduced in > the v4.18 merge window. > > Bart. >
Powered by blists - more mailing lists