From patchwork Fri Apr 21 08:51:00 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?b?SsO8cmdlbiBHcm/Dnw==?= X-Patchwork-Id: 9692205 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 53FD460328 for ; Fri, 21 Apr 2017 08:53:16 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 4E4E22860F for ; Fri, 21 Apr 2017 08:53:16 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 4359E28617; Fri, 21 Apr 2017 08:53:16 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id CB1522860F for ; Fri, 21 Apr 2017 08:53:15 +0000 (UTC) Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1d1UHR-0002Tp-UT; Fri, 21 Apr 2017 08:51:05 +0000 Received: from mail6.bemta6.messagelabs.com ([193.109.254.103]) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1d1UHQ-0002Ti-1E for xen-devel@lists.xenproject.org; Fri, 21 Apr 2017 08:51:04 +0000 Received: from [193.109.254.147] by server-9.bemta-6.messagelabs.com id 79/A8-03557-7F7C9F85; Fri, 21 Apr 2017 08:51:03 +0000 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFjrFLMWRWlGSWpSXmKPExsVyuP0Ov+634z8 jDOavN7X4vmUykwOjx+EPV1gCGKNYM/OS8isSWDMeXJzNVPBNpOLqhWNsDYw/BbsYOTkkBIwk 3k78x9TFyMUhJLCQUeLWiu1sIAk2AVWJDddPsYLYIgKOEqvbloLZzAI5EjvnzgGzhYHiHVfaw epZgOo/9TxnB7F5BUwknv6aygSxQF5i0aYZLBMYORcwMqxi1ChOLSpLLdI1NtRLKspMzyjJTc zM0TU0MNPLTS0uTkxPzUlMKtZLzs/dxAj0FwMQ7GBsWhR4iFGSg0lJlPdqx88IIb6k/JTKjMT ijPii0pzU4kOMMhwcShK8748B5QSLUtNTK9Iyc4CBA5OW4OBREuG9A5LmLS5IzC3OTIdInWLU 5Xi39MN7JiGWvPy8VClxXkWQIgGQoozSPLgRsCC+xCgrJczLCHSUEE9BalFuZgmq/CtGcQ5GJ WHe5yBTeDLzSuA2vQI6ggnoiLN+P0COKElESEk1MNq//PTJp+pQi4fGrYSpzxu5J345xSq6jM fb9/k5XU+tWCal7+n9Z++27rKYKrHbuDCOq1Ca+e/pxyvSc540TvX7y/9skaTG2fATz1kmbji 3boelVVxp5APPhvO3k80nlDZqKTXYxmwo3fBWTePvovVnzllfvns+N8Daa//+15w23ApSTR+v iCixFGckGmoxFxUnAgAi04yHXQIAAA== X-Env-Sender: jgross@suse.com X-Msg-Ref: server-6.tower-27.messagelabs.com!1492764662!98463269!1 X-Originating-IP: [195.135.220.15] X-SpamReason: No, hits=0.0 required=7.0 tests= X-StarScan-Received: X-StarScan-Version: 9.4.12; banners=-,-,- X-VirusChecked: Checked Received: (qmail 1060 invoked from network); 21 Apr 2017 08:51:02 -0000 Received: from mx2.suse.de (HELO mx1.suse.de) (195.135.220.15) by server-6.tower-27.messagelabs.com with DHE-RSA-CAMELLIA256-SHA encrypted SMTP; 21 Apr 2017 08:51:02 -0000 X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (charybdis-ext.suse.de [195.135.220.254]) by mx1.suse.de (Postfix) with ESMTP id 3A7FBAD18; Fri, 21 Apr 2017 08:51:02 +0000 (UTC) From: Juergen Gross To: linux-kernel@vger.kernel.org, xen-devel@lists.xenproject.org Date: Fri, 21 Apr 2017 10:51:00 +0200 Message-Id: <20170421085100.26210-1-jgross@suse.com> X-Mailer: git-send-email 2.12.0 Cc: Juergen Gross , roger.pau@citrix.com, stable@vger.kernel.org Subject: [Xen-devel] [PATCH] xen/blkback: fix disconnect while I/Os in flight X-BeenThere: xen-devel@lists.xen.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: xen-devel-bounces@lists.xen.org Sender: "Xen-devel" X-Virus-Scanned: ClamAV using ClamSMTP Today disconnecting xen-blkback is broken in case there are still I/Os in flight: xen_blkif_disconnect() will bail out early without releasing all resources in the hope it will be called again when the last request has terminated. This, however, won't happen as xen_blkif_free() won't be called on termination of the last running request: xen_blkif_put() won't decrement the blkif refcnt to 0 as xen_blkif_disconnect() didn't finish before thus some xen_blkif_put() calls in xen_blkif_disconnect() didn't happen. To solve this deadlock xen_blkif_disconnect() and xen_blkif_alloc_rings() shouldn't use xen_blkif_put() and xen_blkif_get() but use some other way to do their accounting of resources. This at once fixes another error in xen_blkif_disconnect(): when it returned early with -EBUSY for another ring than 0 it would call xen_blkif_put() again for already handled rings on a subsequent call. This will lead to inconsistencies in the refcnt handling. Cc: stable@vger.kernel.org Signed-off-by: Juergen Gross Tested-by: Steven Haigh Acked-by: Roger Pau Monné --- drivers/block/xen-blkback/common.h | 1 + drivers/block/xen-blkback/xenbus.c | 7 +++++-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/block/xen-blkback/common.h b/drivers/block/xen-blkback/common.h index dea61f6ab8cb..953f38802333 100644 --- a/drivers/block/xen-blkback/common.h +++ b/drivers/block/xen-blkback/common.h @@ -281,6 +281,7 @@ struct xen_blkif_ring { wait_queue_head_t wq; atomic_t inflight; + int active; /* One thread per blkif ring. */ struct task_struct *xenblkd; unsigned int waiting_reqs; diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c index 8fe61b5dc5a6..411d2ded2456 100644 --- a/drivers/block/xen-blkback/xenbus.c +++ b/drivers/block/xen-blkback/xenbus.c @@ -159,7 +159,7 @@ static int xen_blkif_alloc_rings(struct xen_blkif *blkif) init_waitqueue_head(&ring->shutdown_wq); ring->blkif = blkif; ring->st_print = jiffies; - xen_blkif_get(blkif); + ring->active = 1; } return 0; @@ -249,6 +249,9 @@ static int xen_blkif_disconnect(struct xen_blkif *blkif) struct xen_blkif_ring *ring = &blkif->rings[r]; unsigned int i = 0; + if (!ring->active) + continue; + if (ring->xenblkd) { kthread_stop(ring->xenblkd); wake_up(&ring->shutdown_wq); @@ -296,7 +299,7 @@ static int xen_blkif_disconnect(struct xen_blkif *blkif) BUG_ON(ring->free_pages_num != 0); BUG_ON(ring->persistent_gnt_c != 0); WARN_ON(i != (XEN_BLKIF_REQS_PER_PAGE * blkif->nr_ring_pages)); - xen_blkif_put(blkif); + ring->active = 0; } blkif->nr_ring_pages = 0; /*