From patchwork Tue Dec 18 07:08:45 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Kashyap Desai X-Patchwork-Id: 10734933 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 6E3C4924 for ; Tue, 18 Dec 2018 07:08:58 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 5C9AD29946 for ; Tue, 18 Dec 2018 07:08:58 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 4E31929953; Tue, 18 Dec 2018 07:08:58 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id A7EE529942 for ; Tue, 18 Dec 2018 07:08:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726368AbeLRHI5 (ORCPT ); Tue, 18 Dec 2018 02:08:57 -0500 Received: from mail-it1-f195.google.com ([209.85.166.195]:55546 "EHLO mail-it1-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726316AbeLRHI5 (ORCPT ); Tue, 18 Dec 2018 02:08:57 -0500 Received: by mail-it1-f195.google.com with SMTP id m62so2578015ith.5 for ; Mon, 17 Dec 2018 23:08:56 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=broadcom.com; s=google; h=mime-version:from:date:message-id:subject:to:cc :content-transfer-encoding; bh=HVnA6gNLAJJbGRnmjJSrKTONznADz2Idt1LWQFZBLSc=; b=NDJwzw+/VeE/E6rPIIJV7cRcPOEzRAbv2aA2oeaYAT51MrA6/O5LKT/55LbPIakLlK Sg4IpOZaa2vsdEg00qccq+l80nSZzWwqMRa5Pr2pfucvMGOAOG3ptYehN+Up5ohYjJqF rD7WLm9yxWRiocqdo60CRKQ3Jhx/+ulWZcA/I= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to:cc :content-transfer-encoding; bh=HVnA6gNLAJJbGRnmjJSrKTONznADz2Idt1LWQFZBLSc=; b=MTNaMA/1SjK/teIMmTvLlhhdQ3tKKUJ4D/TRXPvtzlyc71YfgK4JILzFPiH+51GLlh f3rgrXu9ORjRTT/BVDtUGJq8ojqEd+YLXCPnCFzsNNucLx5cv/opFtPNP6ssj4//WKqw kgyiQ+hz/lwUt7uQSPA7GZXu8BSUPCgxqFBhI8pE85de2MIDuRYPWH5azEFyrFL2QnB6 2cS+ezQ6wkarBycy07xBX+F/yXTVJwPjaDzMg+3Q6/5Yf/Dz8U/gMkBaZ7eY41ppsSBG rFTgCriURx9ALPBiOo6+4d7PaZNECvLQXqBzC0SSLxDRSe5wL9/6Y8X/skjCXE04qst4 LZlQ== X-Gm-Message-State: AA+aEWacXPawbmte+Q5Ds/hj18D9+i+/vkSwst5W+d0LAhKL9SdO1i5i 17wRL2D14QkYcfOOFqb8tp37dygjcfWkWGdykXDB/w== X-Google-Smtp-Source: AFSGD/WGytnA4xRMJtzgRLold+uZhXRhy8DX5Gjye6LEs4C6SErAOa5F4j86nEPmxbHWNhWDfatQZKn06sSYGvhPPcI= X-Received: by 2002:a24:c9c6:: with SMTP id h189mr2002755itg.175.1545116936044; Mon, 17 Dec 2018 23:08:56 -0800 (PST) MIME-Version: 1.0 From: Kashyap Desai Date: Tue, 18 Dec 2018 12:38:45 +0530 Message-ID: Subject: [PATCH V2] blk-mq: Set request mapping to NULL in blk_mq_put_driver_tag To: linux-block , Jens Axboe , linux-scsi Cc: Ming Lei , Suganath Prabu Subramani , Sreekanth Reddy , Sathya Prakash , Bart Van Assche Sender: linux-scsi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-scsi@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP V1 -> V2 Added fix in __blk_mq_finish_request around blk_mq_put_tag() for non-internal tags Problem statement : Whenever try to get outstanding request via scsi_host_find_tag, block layer will return stale entries instead of actual outstanding request. Kernel panic if stale entry is inaccessible or memory is reused. Fix : Undo request mapping in blk_mq_put_driver_tag nce request is return. More detail : Whenever each SDEV entry is created, block layer allocate separate tags and static requestis.Those requests are not valid after SDEV is deleted from the system. On the fly, block layer maps static rqs to rqs as below from blk_mq_get_driver_tag() data.hctx->tags->rqs[rq->tag] = rq; Above mapping is active in-used requests and it is the same mapping which is referred in function scsi_host_find_tag(). After running some IOs, “data.hctx->tags->rqs[rq->tag]” will have some entries which will never be reset in block layer. There would be a kernel panic, If request pointing to “data.hctx->tags->rqs[rq->tag]” is part of “sdev” which is removed and as part of that all the memory allocation of request associated with that sdev might be reused or inaccessible to the driver. Kernel panic snippet - BUG: unable to handle kernel paging request at ffffff8000000010 IP: [] mpt3sas_scsih_scsi_lookup_get+0x6c/0xc0 [mpt3sas] PGD aa4414067 PUD 0 Oops: 0000 [#1] SMP Call Trace: [] mpt3sas_get_st_from_smid+0x1f/0x60 [mpt3sas] [] scsih_shutdown+0x55/0x100 [mpt3sas] Cc: Signed-off-by: Kashyap Desai Signed-off-by: Sreekanth Reddy Reviewed-by: Hannes Reinecke --- block/blk-mq.c | 4 +++- block/blk-mq.h | 1 + 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/block/blk-mq.c b/block/blk-mq.c index 6a75662..88d1e92 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -477,8 +477,10 @@ static void __blk_mq_free_request(struct request *rq) const int sched_tag = rq->internal_tag; blk_pm_mark_last_busy(rq); - if (rq->tag != -1) + if (rq->tag != -1) { + hctx->tags->rqs[rq->tag] = NULL; blk_mq_put_tag(hctx, hctx->tags, ctx, rq->tag); + } if (sched_tag != -1) blk_mq_put_tag(hctx, hctx->sched_tags, ctx, sched_tag); blk_mq_sched_restart(hctx); diff --git a/block/blk-mq.h b/block/blk-mq.h index 9497b47..57432be 100644 --- a/block/blk-mq.h +++ b/block/blk-mq.h @@ -175,6 +175,7 @@ static inline bool blk_mq_get_dispatch_budget(struct blk_mq_hw_ctx *hctx) static inline void __blk_mq_put_driver_tag(struct blk_mq_hw_ctx *hctx, struct request *rq) { + hctx->tags->rqs[rq->tag] = NULL; blk_mq_put_tag(hctx, hctx->tags, rq->mq_ctx, rq->tag); rq->tag = -1;