[PATCH] cnic: Fix ISCSI_KEVENT_IF_DOWN message handling.

[PATCH] cnic: Fix ISCSI_KEVENT_IF_DOWN message handling.

[Michael Chan]

When a net device goes down or when the bnx2i driver is unloaded,
the code was not generating the ISCSI_KEVENT_IF_DOWN message
properly and this could cause the userspace driver to crash.

This is fixed by sending the message properly in the shutdown path.
cnic_uio_stop() is also added to send the message when bnx2i is
unregistering.

Signed-off-by: Michael Chan <mchan@broadcom.com>
---
 drivers/net/cnic.c |   23 +++++++++++++++++++++--
 1 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/drivers/net/cnic.c b/drivers/net/cnic.c
index 4d1515f..4869d77 100644
--- a/drivers/net/cnic.c
+++ b/drivers/net/cnic.c
@@ -227,7 +227,7 @@ static int cnic_send_nlmsg(struct cnic_local *cp, u32 type,
 	}
 
 	rcu_read_lock();
-	ulp_ops = rcu_dereference(cp->ulp_ops[CNIC_ULP_ISCSI]);
+	ulp_ops = rcu_dereference(cnic_ulp_tbl[CNIC_ULP_ISCSI]);
 	if (ulp_ops)
 		ulp_ops->iscsi_nl_send_msg(cp->dev, msg_type, buf, len);
 	rcu_read_unlock();
@@ -319,6 +319,20 @@ static int cnic_abort_prep(struct cnic_sock *csk)
 	return 0;
 }
 
+static void cnic_uio_stop(void)
+{
+	struct cnic_dev *dev;
+
+	read_lock(&cnic_dev_lock);
+	list_for_each_entry(dev, &cnic_dev_list, list) {
+		struct cnic_local *cp = dev->cnic_priv;
+
+		if (cp->cnic_uinfo)
+			cnic_send_nlmsg(cp, ISCSI_KEVENT_IF_DOWN, NULL);
+	}
+	read_unlock(&cnic_dev_lock);
+}
+
 int cnic_register_driver(int ulp_type, struct cnic_ulp_ops *ulp_ops)
 {
 	struct cnic_dev *dev;
@@ -390,6 +404,9 @@ int cnic_unregister_driver(int ulp_type)
 	}
 	read_unlock(&cnic_dev_lock);
 
+	if (ulp_type == CNIC_ULP_ISCSI)
+		cnic_uio_stop();
+
 	rcu_assign_pointer(cnic_ulp_tbl[ulp_type], NULL);
 
 	mutex_unlock(&cnic_lock);
@@ -632,7 +649,6 @@ static void cnic_free_resc(struct cnic_dev *dev)
 	int i = 0;
 
 	if (cp->cnic_uinfo) {
-		cnic_send_nlmsg(cp, ISCSI_KEVENT_IF_DOWN, NULL);
 		while (cp->uio_dev != -1 && i < 15) {
 			msleep(100);
 			i++;
@@ -1057,6 +1073,9 @@ static void cnic_ulp_stop(struct cnic_dev *dev)
 	struct cnic_local *cp = dev->cnic_priv;
 	int if_type;
 
+	if (cp->cnic_uinfo)
+		cnic_send_nlmsg(cp, ISCSI_KEVENT_IF_DOWN, NULL);
+
 	rcu_read_lock();
 	for (if_type = 0; if_type < MAX_CNIC_ULP_TYPE; if_type++) {
 		struct cnic_ulp_ops *ulp_ops;
-- 
1.5.6.GIT

Re: [PATCH] cnic: Fix ISCSI_KEVENT_IF_DOWN message handling.

[David Miller]

From: "Michael Chan" <mchan@broadcom.com>
Date: Wed, 22 Jul 2009 20:01:55 -0700

> When a net device goes down or when the bnx2i driver is unloaded,
> the code was not generating the ISCSI_KEVENT_IF_DOWN message
> properly and this could cause the userspace driver to crash.
> 
> This is fixed by sending the message properly in the shutdown path.
> cnic_uio_stop() is also added to send the message when bnx2i is
> unregistering.
> 
> Signed-off-by: Michael Chan <mchan@broadcom.com>

Applied.

Re: [PATCH] cnic: Fix ISCSI_KEVENT_IF_DOWN message handling.

[Mike Christie]

Michael Chan wrote:
> When a net device goes down or when the bnx2i driver is unloaded,
> the code was not generating the ISCSI_KEVENT_IF_DOWN message
> properly and this could cause the userspace driver to crash.
> 
> This is fixed by sending the message properly in the shutdown path.
> cnic_uio_stop() is also added to send the message when bnx2i is
> unregistering.
> 
> Signed-off-by: Michael Chan <mchan@broadcom.com>
> ---
>  drivers/net/cnic.c |   23 +++++++++++++++++++++--
>  1 files changed, 21 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/cnic.c b/drivers/net/cnic.c
> index 4d1515f..4869d77 100644
> --- a/drivers/net/cnic.c
> +++ b/drivers/net/cnic.c
> @@ -227,7 +227,7 @@ static int cnic_send_nlmsg(struct cnic_local *cp, u32 type,
>  	}
>  
>  	rcu_read_lock();
> -	ulp_ops = rcu_dereference(cp->ulp_ops[CNIC_ULP_ISCSI]);
> +	ulp_ops = rcu_dereference(cnic_ulp_tbl[CNIC_ULP_ISCSI]);
>  	if (ulp_ops)
>  		ulp_ops->iscsi_nl_send_msg(cp->dev, msg_type, buf, len);
>  	rcu_read_unlock();
> @@ -319,6 +319,20 @@ static int cnic_abort_prep(struct cnic_sock *csk)
>  	return 0;
>  }
>  
> +static void cnic_uio_stop(void)
> +{
> +	struct cnic_dev *dev;
> +
> +	read_lock(&cnic_dev_lock);
> +	list_for_each_entry(dev, &cnic_dev_list, list) {
> +		struct cnic_local *cp = dev->cnic_priv;
> +
> +		if (cp->cnic_uinfo)
> +			cnic_send_nlmsg(cp, ISCSI_KEVENT_IF_DOWN, NULL);

I don't think you can call this with the cnic_dev_lock held. They have 
the same sleeping restrictions as a spin_lock right? If so, the problem 
is that iscsi_nl_send_ms calls iscsi_offload_mesg which uses GFP_NOIO 
and can sleep.

Re: [PATCH] cnic: Fix ISCSI_KEVENT_IF_DOWN message handling.

[Michael Chan]

Mike Christie wrote:

> Michael Chan wrote:
> > When a net device goes down or when the bnx2i driver is unloaded,
> > the code was not generating the ISCSI_KEVENT_IF_DOWN message
> > properly and this could cause the userspace driver to crash.
> >
> > This is fixed by sending the message properly in the shutdown path.
> > cnic_uio_stop() is also added to send the message when bnx2i is
> > unregistering.
> >
> > Signed-off-by: Michael Chan <mchan@broadcom.com>
> > ---
> >  drivers/net/cnic.c |   23 +++++++++++++++++++++--
> >  1 files changed, 21 insertions(+), 2 deletions(-)
> >
> > diff --git a/drivers/net/cnic.c b/drivers/net/cnic.c
> > index 4d1515f..4869d77 100644
> > --- a/drivers/net/cnic.c
> > +++ b/drivers/net/cnic.c
> > @@ -227,7 +227,7 @@ static int cnic_send_nlmsg(struct
> cnic_local *cp, u32 type,
> >     }
> >
> >     rcu_read_lock();
> > -   ulp_ops = rcu_dereference(cp->ulp_ops[CNIC_ULP_ISCSI]);
> > +   ulp_ops = rcu_dereference(cnic_ulp_tbl[CNIC_ULP_ISCSI]);
> >     if (ulp_ops)
> >             ulp_ops->iscsi_nl_send_msg(cp->dev, msg_type, buf, len);
> >     rcu_read_unlock();
> > @@ -319,6 +319,20 @@ static int cnic_abort_prep(struct
> cnic_sock *csk)
> >     return 0;
> >  }
> >
> > +static void cnic_uio_stop(void)
> > +{
> > +   struct cnic_dev *dev;
> > +
> > +   read_lock(&cnic_dev_lock);
> > +   list_for_each_entry(dev, &cnic_dev_list, list) {
> > +           struct cnic_local *cp = dev->cnic_priv;
> > +
> > +           if (cp->cnic_uinfo)
> > +                   cnic_send_nlmsg(cp, ISCSI_KEVENT_IF_DOWN, NULL);
>
> I don't think you can call this with the cnic_dev_lock held.
> They have
> the same sleeping restrictions as a spin_lock right? If so,
> the problem
> is that iscsi_nl_send_ms calls iscsi_offload_mesg which uses GFP_NOIO
> and can sleep.
>
>
In that case, can I send in a patch to change iscsi_offload_mesg() to
use GFP_ATOMIC?

Re: [PATCH] cnic: Fix ISCSI_KEVENT_IF_DOWN message handling.

[Mike Christie]

Michael Chan wrote:
> Mike Christie wrote:
> 
>> Michael Chan wrote:
>>> When a net device goes down or when the bnx2i driver is unloaded,
>>> the code was not generating the ISCSI_KEVENT_IF_DOWN message
>>> properly and this could cause the userspace driver to crash.
>>>
>>> This is fixed by sending the message properly in the shutdown path.
>>> cnic_uio_stop() is also added to send the message when bnx2i is
>>> unregistering.
>>>
>>> Signed-off-by: Michael Chan <mchan@broadcom.com>
>>> ---
>>>  drivers/net/cnic.c |   23 +++++++++++++++++++++--
>>>  1 files changed, 21 insertions(+), 2 deletions(-)
>>>
>>> diff --git a/drivers/net/cnic.c b/drivers/net/cnic.c
>>> index 4d1515f..4869d77 100644
>>> --- a/drivers/net/cnic.c
>>> +++ b/drivers/net/cnic.c
>>> @@ -227,7 +227,7 @@ static int cnic_send_nlmsg(struct
>> cnic_local *cp, u32 type,
>>>     }
>>>
>>>     rcu_read_lock();
>>> -   ulp_ops = rcu_dereference(cp->ulp_ops[CNIC_ULP_ISCSI]);
>>> +   ulp_ops = rcu_dereference(cnic_ulp_tbl[CNIC_ULP_ISCSI]);
>>>     if (ulp_ops)
>>>             ulp_ops->iscsi_nl_send_msg(cp->dev, msg_type, buf, len);
>>>     rcu_read_unlock();
>>> @@ -319,6 +319,20 @@ static int cnic_abort_prep(struct
>> cnic_sock *csk)
>>>     return 0;
>>>  }
>>>
>>> +static void cnic_uio_stop(void)
>>> +{
>>> +   struct cnic_dev *dev;
>>> +
>>> +   read_lock(&cnic_dev_lock);
>>> +   list_for_each_entry(dev, &cnic_dev_list, list) {
>>> +           struct cnic_local *cp = dev->cnic_priv;
>>> +
>>> +           if (cp->cnic_uinfo)
>>> +                   cnic_send_nlmsg(cp, ISCSI_KEVENT_IF_DOWN, NULL);
>> I don't think you can call this with the cnic_dev_lock held.
>> They have
>> the same sleeping restrictions as a spin_lock right? If so,
>> the problem
>> is that iscsi_nl_send_ms calls iscsi_offload_mesg which uses GFP_NOIO
>> and can sleep.
>>
>>
> In that case, can I send in a patch to change iscsi_offload_mesg() to
> use GFP_ATOMIC?
> 

Yes, I guess so.

Re: [PATCH] cnic: Fix ISCSI_KEVENT_IF_DOWN message handling.

[Anil Veerabhadrappa]

On Wed, 2009-07-29 at 00:55 -0700, Michael Chan wrote:
> Mike Christie wrote:
> 
> > Michael Chan wrote:
> > > When a net device goes down or when the bnx2i driver is unloaded,
> > > the code was not generating the ISCSI_KEVENT_IF_DOWN message
> > > properly and this could cause the userspace driver to crash.
> > >
> > > This is fixed by sending the message properly in the shutdown
> path.
> > > cnic_uio_stop() is also added to send the message when bnx2i is
> > > unregistering.
> > >
> > > Signed-off-by: Michael Chan <mchan@broadcom.com>
> > > ---
> > >  drivers/net/cnic.c |   23 +++++++++++++++++++++--
> > >  1 files changed, 21 insertions(+), 2 deletions(-)
> > >
> > > diff --git a/drivers/net/cnic.c b/drivers/net/cnic.c
> > > index 4d1515f..4869d77 100644
> > > --- a/drivers/net/cnic.c
> > > +++ b/drivers/net/cnic.c
> > > @@ -227,7 +227,7 @@ static int cnic_send_nlmsg(struct
> > cnic_local *cp, u32 type,
> > >     }
> > >
> > >     rcu_read_lock();
> > > -   ulp_ops = rcu_dereference(cp->ulp_ops[CNIC_ULP_ISCSI]);
> > > +   ulp_ops = rcu_dereference(cnic_ulp_tbl[CNIC_ULP_ISCSI]);
> > >     if (ulp_ops)
> > >             ulp_ops->iscsi_nl_send_msg(cp->dev, msg_type, buf,
> len);
> > >     rcu_read_unlock();
> > > @@ -319,6 +319,20 @@ static int cnic_abort_prep(struct
> > cnic_sock *csk)
> > >     return 0;
> > >  }
> > >
> > > +static void cnic_uio_stop(void)
> > > +{
> > > +   struct cnic_dev *dev;
> > > +
> > > +   read_lock(&cnic_dev_lock);
> > > +   list_for_each_entry(dev, &cnic_dev_list, list) {
> > > +           struct cnic_local *cp = dev->cnic_priv;
> > > +
> > > +           if (cp->cnic_uinfo)
> > > +                   cnic_send_nlmsg(cp, ISCSI_KEVENT_IF_DOWN,
> NULL);
> >
> > I don't think you can call this with the cnic_dev_lock held.
> > They have
> > the same sleeping restrictions as a spin_lock right? If so,
> > the problem
> > is that iscsi_nl_send_ms calls iscsi_offload_mesg which uses
> GFP_NOIO
> > and can sleep.
> >
> >
> In that case, can I send in a patch to change iscsi_offload_mesg() to
> use GFP_ATOMIC?
> 
After this change, if iscsi_transport is unable to push the message to
user daemon because of memory issues, will the original issue of uio
crash re-appear?

Original issue: A did not notify B
Fix : A calls C to send message to B
      if C cannot deliver message to B, original problem stays???


> 
> --~--~---------~--~----~------------~-------~--~----~
> You received this message because you are subscribed to the Google Groups "open-iscsi" group.
> To post to this group, send email to open-iscsi@googlegroups.com
> To unsubscribe from this group, send email to open-iscsi+unsubscribe@googlegroups.com
> For more options, visit this group at http://groups.google.com/group/open-iscsi
> -~----------~----~----~----~------~----~------~--~---
> 
> 

[PATCH] iscsi: Use GFP_ATOMIC in iscsi_offload_mesg().

[Michael Chan]

Changing to GFP_ATOMIC because the only caller in cnic/bnx2i may
be calling this function while holding spin_lock.

This problem was discovered by Mike Christie.

Signed-off-by: Michael Chan <mchan-dY08KVG/lbpWk0Htik3J/w@public.gmane.org>
---
 drivers/scsi/scsi_transport_iscsi.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
index 783e33c..b47240c 100644
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -990,7 +990,7 @@ int iscsi_offload_mesg(struct Scsi_Host *shost,
 	struct iscsi_uevent *ev;
 	int len = NLMSG_SPACE(sizeof(*ev) + data_size);
 
-	skb = alloc_skb(len, GFP_NOIO);
+	skb = alloc_skb(len, GFP_ATOMIC);
 	if (!skb) {
 		printk(KERN_ERR "can not deliver iscsi offload message:OOM\n");
 		return -ENOMEM;
@@ -1012,7 +1012,7 @@ int iscsi_offload_mesg(struct Scsi_Host *shost,
 
 	memcpy((char *)ev + sizeof(*ev), data, data_size);
 
-	return iscsi_multicast_skb(skb, ISCSI_NL_GRP_UIP, GFP_NOIO);
+	return iscsi_multicast_skb(skb, ISCSI_NL_GRP_UIP, GFP_ATOMIC);
 }
 EXPORT_SYMBOL_GPL(iscsi_offload_mesg);
 
-- 
1.5.6.GIT

Re: [PATCH] iscsi: Use GFP_ATOMIC in iscsi_offload_mesg().

[Mike Christie]

On 07/29/2009 01:49 PM, Michael Chan wrote:
> Changing to GFP_ATOMIC because the only caller in cnic/bnx2i may
> be calling this function while holding spin_lock.
>
> This problem was discovered by Mike Christie.
>
> Signed-off-by: Michael Chan<mchan-dY08KVG/lbpWk0Htik3J/w@public.gmane.org>
> ---
>   drivers/scsi/scsi_transport_iscsi.c |    4 ++--
>   1 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
> index 783e33c..b47240c 100644
> --- a/drivers/scsi/scsi_transport_iscsi.c
> +++ b/drivers/scsi/scsi_transport_iscsi.c
> @@ -990,7 +990,7 @@ int iscsi_offload_mesg(struct Scsi_Host *shost,
>   	struct iscsi_uevent *ev;
>   	int len = NLMSG_SPACE(sizeof(*ev) + data_size);
>
> -	skb = alloc_skb(len, GFP_NOIO);
> +	skb = alloc_skb(len, GFP_ATOMIC);
>   	if (!skb) {
>   		printk(KERN_ERR "can not deliver iscsi offload message:OOM\n");
>   		return -ENOMEM;
> @@ -1012,7 +1012,7 @@ int iscsi_offload_mesg(struct Scsi_Host *shost,
>
>   	memcpy((char *)ev + sizeof(*ev), data, data_size);
>
> -	return iscsi_multicast_skb(skb, ISCSI_NL_GRP_UIP, GFP_NOIO);
> +	return iscsi_multicast_skb(skb, ISCSI_NL_GRP_UIP, GFP_ATOMIC);
>   }
>   EXPORT_SYMBOL_GPL(iscsi_offload_mesg);
>

Using GFP_NOIO and changing the locking is my preference normally,  but 
if the locking changes are going to be a problem, then this is ok with 
me since we can fail allocations in other parts of the code.

Acked-by: Mike Christie <michaelc-hcNo3dDEHLuVc3sceRu5cw@public.gmane.org>

Dave Miller probably wants to take this in his tree since it fixes a bug 
with this patch
http://git.kernel.org/?p=linux/kernel/git/davem/net-2.6.git;a=commit;h=6d7760a88c25057c2c2243e5dfe2d731064bd31d

Re: [PATCH] iscsi: Use GFP_ATOMIC in iscsi_offload_mesg().

[David Miller]

From: Mike Christie <michaelc@cs.wisc.edu>
Date: Wed, 29 Jul 2009 20:40:50 -0500

> On 07/29/2009 01:49 PM, Michael Chan wrote:
>> Changing to GFP_ATOMIC because the only caller in cnic/bnx2i may
>> be calling this function while holding spin_lock.
>>
>> This problem was discovered by Mike Christie.
>>
>> Signed-off-by: Michael Chan<mchan@broadcom.com>
 ...
> Acked-by: Mike Christie <michaelc@cs.wisc.edu>
> 
> Dave Miller probably wants to take this in his tree since it fixes a
> bug with this patch
> http://git.kernel.org/?p=linux/kernel/git/davem/net-2.6.git;a=commit;h=6d7760a88c25057c2c2243e5dfe2d731064bd31d

Yep I'll take it, thanks everyone.