Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1466181

[PATCH 3.12 025/100] scsi: fix race between simultaneous decrements of ->host_failed

Show all headers | View raw

From: Wei Fang <fangwei1@huawei.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 72d8c36ec364c82bf1bf0c64dfa1041cfaf139f7 upstream.

sas_ata_strategy_handler() adds the works of the ata error handler to
system_unbound_wq. This workqueue asynchronously runs work items, so the
ata error handler will be performed concurrently on different CPUs. In
this case, ->host_failed will be decreased simultaneously in
scsi_eh_finish_cmd() on different CPUs, and become abnormal.

It will lead to permanently inequality between ->host_failed and
->host_busy, and scsi error handler thread won't start running. IO
errors after that won't be handled.

Since all scmds must have been handled in the strategy handler, just
remove the decrement in scsi_eh_finish_cmd() and zero ->host_busy after
the strategy handler to fix this race.

Fixes: 50824d6c5657 ("[SCSI] libsas: async ata-eh")
Signed-off-by: Wei Fang <fangwei1@huawei.com>
Reviewed-by: James Bottomley <jejb@linux.vnet.ibm.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 Documentation/scsi/scsi_eh.txt | 8 ++++++--
 drivers/ata/libata-eh.c        | 2 +-
 drivers/scsi/scsi_error.c      | 4 +++-
 3 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/Documentation/scsi/scsi_eh.txt b/Documentation/scsi/scsi_eh.txt
index 6ff16b620d84..c08b62d63afa 100644
--- a/Documentation/scsi/scsi_eh.txt
+++ b/Documentation/scsi/scsi_eh.txt
@@ -255,19 +255,23 @@ scmd->allowed.
 
  3. scmd recovered
     ACTION: scsi_eh_finish_cmd() is invoked to EH-finish scmd
-	- shost->host_failed--
 	- clear scmd->eh_eflags
 	- scsi_setup_cmd_retry()
 	- move from local eh_work_q to local eh_done_q
     LOCKING: none
+    CONCURRENCY: at most one thread per separate eh_work_q to
+		 keep queue manipulation lockless
 
  4. EH completes
     ACTION: scsi_eh_flush_done_q() retries scmds or notifies upper
-	    layer of failure.
+	    layer of failure. May be called concurrently but must have
+	    a no more than one thread per separate eh_work_q to
+	    manipulate the queue locklessly
 	- scmd is removed from eh_done_q and scmd->eh_entry is cleared
 	- if retry is necessary, scmd is requeued using
           scsi_queue_insert()
 	- otherwise, scsi_finish_command() is invoked for scmd
+	- zero shost->host_failed
     LOCKING: queue or finish function performs appropriate locking
 
 
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index 063036d876b0..126eb86f239f 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -604,7 +604,7 @@ void ata_scsi_error(struct Scsi_Host *host)
 	ata_scsi_port_error_handler(host, ap);
 
 	/* finish or retry handled scmd's and clean up */
-	WARN_ON(host->host_failed || !list_empty(&eh_work_q));
+	WARN_ON(!list_empty(&eh_work_q));
 
 	DPRINTK("EXIT\n");
 }
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index ff2689d01209..bb40359ba620 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -960,7 +960,6 @@ static int scsi_request_sense(struct scsi_cmnd *scmd)
  */
 void scsi_eh_finish_cmd(struct scsi_cmnd *scmd, struct list_head *done_q)
 {
-	scmd->device->host->host_failed--;
 	scmd->eh_eflags = 0;
 	list_move_tail(&scmd->eh_entry, done_q);
 }
@@ -1949,6 +1948,9 @@ int scsi_error_handler(void *data)
 		else
 			scsi_unjam_host(shost);
 
+		/* All scmds have been handled */
+		shost->host_failed = 0;
+
 		/*
 		 * Note - if the above fails completely, the action is to take
 		 * individual devices offline and flush the queue of any
-- 
2.9.3

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.12 000/100] 3.12.63-stable review Jiri Slaby <jslaby@suse.cz> - 2016-08-19 09:20 +0200
  [PATCH 3.12 001/100] x86/mm: Add barriers and document switch_mm()-vs-flush synchronization Jiri Slaby <jslaby@suse.cz> - 2016-08-19 09:40 +0200
    [PATCH 3.12 002/100] mm: migrate dirty page without clear_page_dirty_for_io etc Jiri Slaby <jslaby@suse.cz> - 2016-08-19 09:40 +0200
    [PATCH 3.12 004/100] printk: do cond_resched() between lines while outputting to consoles Jiri Slaby <jslaby@suse.cz> - 2016-08-19 09:40 +0200
  [PATCH 3.12 009/100] libceph: set 'exists' flag for newly up osd Jiri Slaby <jslaby@suse.cz> - 2016-08-19 09:40 +0200
    [PATCH 3.12 024/100] ALSA: ctl: Stop notification after disconnection Jiri Slaby <jslaby@suse.cz> - 2016-08-19 09:40 +0200
    [PATCH 3.12 021/100] tty/vt/keyboard: fix OOB access in do_compute_shiftstate() Jiri Slaby <jslaby@suse.cz> - 2016-08-19 09:40 +0200
    [PATCH 3.12 015/100] iio: Fix error handling in iio_trigger_attach_poll_func Jiri Slaby <jslaby@suse.cz> - 2016-08-19 09:40 +0200
    [PATCH 3.12 020/100] iio:ad7266: Fix probe deferral for vref Jiri Slaby <jslaby@suse.cz> - 2016-08-19 09:40 +0200
    [PATCH 3.12 011/100] kvm: Fix irq route entries exceeding KVM_MAX_IRQ_ROUTES Jiri Slaby <jslaby@suse.cz> - 2016-08-19 09:40 +0200
    [PATCH 3.12 025/100] scsi: fix race between simultaneous decrements of ->host_failed Jiri Slaby <jslaby@suse.cz> - 2016-08-19 09:40 +0200
    [PATCH 3.12 022/100] ALSA: dummy: Fix a use-after-free at closing Jiri Slaby <jslaby@suse.cz> - 2016-08-19 09:40 +0200
    [PATCH 3.12 023/100] ALSA: au88x0: Fix calculation in vortex_wtdma_bufshift() Jiri Slaby <jslaby@suse.cz> - 2016-08-19 09:40 +0200
    [PATCH 3.12 016/100] staging: iio: accel: fix error check Jiri Slaby <jslaby@suse.cz> - 2016-08-19 09:40 +0200
    [PATCH 3.12 026/100] Fix reconnect to not defer smb3 session reconnect long after socket reconnect Jiri Slaby <jslaby@suse.cz> - 2016-08-19 09:40 +0200
  [PATCH 3.12 009/101] netfilter: x_tables: speed up jump target validation Jiri Slaby <jslaby@suse.cz> - 2016-08-19 10:00 +0200
  Re: [PATCH 3.12 000/100] 3.12.63-stable review Guenter Roeck <linux@roeck-us.net> - 2016-08-19 21:10 +0200

csiph-web