linux-kernel - Re: [EXT] [RFC 0/2] Serialize timeout handling and done callback.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 31 May 2021 02:06:24 -0700
From:   Arun Easi <aeasi@...vell.com>
To:     Daniel Wagner <dwagner@...e.de>
CC:     <linux-scsi@...r.kernel.org>,
        <GR-QLogic-Storage-Upstream@...vell.com>,
        <linux-kernel@...r.kernel.org>, Nilesh Javali <njavali@...vell.com>
Subject: Re: [EXT] [RFC 0/2] Serialize timeout handling and done callback.

On Fri, 7 May 2021, 5:31am, Daniel Wagner wrote:

> External Email
> 
> ----------------------------------------------------------------------
> Hi,
> 
> We got a customer report where qla2xxx was crashing only if the kernel
> was booting and ql2xextended_error_logging was set. Loading the module
> with the log option didn't trigger the crash.
> 
> After starring for a long time at the crash report I figured the
> problem might be a race between the timeout handler and done callback.
> I've come up with these patches here but unfortunatly, our customer is
> not able to reproduce the problem in the lab anymore (it was caused by
> a hardware issue which got fixed). So for these patches I don't have
> any feedback.

Thanks Daniel for the report and your effort here. Agree, this needs to be 
fixed.

> 
> Maybe they make sense to add the driver even if I don't have prove it
> really address the mentioned bug hence this is marked as RFC.

If you do not mind, can I take this from here? This touches quite a 
number of paths, and I would like to have this go through a full 
regression cycle before this is merged.

That said, I had some general comments:

1. I see sp->lock was introduced, but could not locate where it was used.
2. I did not see a release of lock after a successful kref_put_lock, maybe 
   that piece was missed out.
3. The sp->done should be invoked only once, and I do not see if this is
   taken care of.
4. sp->cmd_sp could be a SCSI IO too, where sp is not allocated 
   separately, so qla2x00_sp_release shall not be called for it.

Regards,
-Arun

> 
> Thanks,
> Daniel
> 
> Daniel Wagner (2):
>   qla2xxx: Refactor asynchronous command initialization
>   qla2xxx: Do not free resource to early in qla24xx_async_gpsc_sp_done()
> 
>  drivers/scsi/qla2xxx/qla_def.h    |  5 ++
>  drivers/scsi/qla2xxx/qla_gbl.h    |  4 +-
>  drivers/scsi/qla2xxx/qla_gs.c     | 86 ++++++++++-------------------
>  drivers/scsi/qla2xxx/qla_init.c   | 91 +++++++++++++------------------
>  drivers/scsi/qla2xxx/qla_iocb.c   | 54 +++++++++++++-----
>  drivers/scsi/qla2xxx/qla_mbx.c    | 11 ++--
>  drivers/scsi/qla2xxx/qla_mid.c    |  5 +-
>  drivers/scsi/qla2xxx/qla_mr.c     |  7 +--
>  drivers/scsi/qla2xxx/qla_target.c |  6 +-
>  9 files changed, 127 insertions(+), 142 deletions(-)
> 
>