From: "Steve Wise" <swise@opengridcomputing.com>
To: linux-scsi@vger.kernel.org
Subject: crash in iscsi/scsi initiator with linux-4.15.0-rc1
Date: Fri, 1 Dec 2017 11:00:16 -0600 [thread overview]
Message-ID: <000201d36ac5$dc96d390$95c47ab0$@opengridcomputing.com> (raw)
Hey,
I'm seeing this null pointer dereference with linux-4.15.0-rc1. To reproduce
it, I connect two ram disks via iscsi/TCP, and start an fio:
iscsiadm -m discovery --op update --type sendtargets -p 172.16.1.10:3260
iscsiadm -m node -p 172.16.1.10:3260 -l
ISCSI_DISKS=/dev/sdd:/dev/sde; fio --rw=randrw --name=random --norandommap
--ioengine=libaio --size=400m --group_reporting --exitall --fsync_on_close=1
--invalidate=1 --direct=1 --filename=$ISCSI_DISKS --time_based --runtime=300
--iodepth=128 --numjobs=8 --unit_base=1 --bs=64k --kb_base=1000
Then on the initiator node, while the fio test is running, I detach the devices:
iscsiadm -m node -p 172.16.1.10:3260 -I iser -u
Then I hit this crash. Has anyone else encountered this issue? Wondering if
there is a fix handy. :)
Thanks,
Steve.
----
[ 127.175953] scsi 8:0:0:0: alua: Detached
[ 127.175955] scsi 8:0:0:0: alua: Detached
[ 127.175981] ------------[ cut here ]------------
[ 127.175984] list_del corruption. prev->next should be ffff8803382f1240, but
was ffff88039ab0f780
[ 127.176010] WARNING: CPU: 5 PID: 373 at lib/list_debug.c:53
__list_del_entry_valid+0x7c/0xa0
[ 127.176011] Modules linked in: iscsi_tcp libiscsi_tcp rpcrdma ib_isert
iscsi_target_mod libiscsi scsi_transport_iscsi ib_srpt target_core_mod ib_srp
scsi_transport_srp ib_ipoib rdma_ucm ib_ucm ib_uverbs ib_umad rdma_cm ib_cm
iw_cm libcxgb mlx5_ib ext4 ib_core dm_mirror dm_region_hash dm_log dm_mod
mbcache jbd2 coretemp kvm iTCO_wdt ppdev irqbypass iTCO_vendor_support gpio_ich
i2c_i801 pcspkr lpc_ich parport_pc i5400_edac sg parport i5k_amb shpchp nfsd
auth_rpcgss nfs_acl lockd grace sunrpc ip_tables xfs libcrc32c sr_mod nouveau
cdrom sd_mod ata_generic pata_acpi video mxm_wmi wmi drm_kms_helper syscopyarea
sysfillrect sysimgblt fb_sys_fops ttm mlx5_core drm igb cxgb4 ahci firewire_ohci
ata_piix libahci firewire_core dca i2c_algo_bit devlink libata ptp serio_raw
i2c_core crc_itu_t pps_core [last unloaded: ib_iser]
[ 127.176055] CPU: 5 PID: 373 Comm: kworker/u16:4 Not tainted 4.15.0-rc1+ #6
[ 127.176056] Hardware name: Supermicro X7DWA/X7DWA, BIOS 6.00 12/21/2007
[ 127.176074] Workqueue: scsi_wq_9 __iscsi_unbind_session
[scsi_transport_iscsi]
[ 127.176075] task: ffff88039a498000 task.stack: ffffc90002880000
[ 127.176076] RIP: 0010:__list_del_entry_valid+0x7c/0xa0
[ 127.176076] RSP: 0018:ffffc90002883d38 EFLAGS: 00010082
[ 127.176077] RAX: 0000000000000000 RBX: ffff8803382f1240 RCX: 0000000000000000
[ 127.176078] RDX: 0000000000000001 RSI: 0000000000000002 RDI: 0000000000000092
[ 127.176079] RBP: ffff8803982129c0 R08: 0000000000000054 R09: ffffffff823d60e0
[ 127.176079] R10: 0000000000000473 R11: 0000000000000000 R12: ffff880398212800
[ 127.176080] R13: ffff880396701800 R14: ffff880396701800 R15: ffff8801afc31000
[ 127.176081] FS: 0000000000000000(0000) GS:ffff8803bfd40000(0000)
knlGS:0000000000000000
[ 127.176082] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 127.176083] CR2: 00007f6a80028038 CR3: 000000039a957000 CR4: 00000000000006e0
[ 127.176084] Call Trace:
[ 127.176091] alua_bus_detach+0x5c/0xc0
[ 127.176095] scsi_dh_release_device+0x18/0x50
[ 127.176098] scsi_device_dev_release_usercontext+0x25/0x230
[ 127.176107] execute_in_process_context+0x58/0x60
[ 127.176110] device_release+0x2d/0x80
[ 127.176113] kobject_cleanup+0x5e/0x180
[ 127.176115] scsi_remove_target+0x16b/0x1b0
[ 127.176119] __iscsi_unbind_session+0xb3/0x160 [scsi_transport_iscsi]
[ 127.176121] process_one_work+0x141/0x340
[ 127.176123] worker_thread+0x47/0x3e0
[ 127.176124] kthread+0xf5/0x130
[ 127.176126] ? rescuer_thread+0x380/0x380
[ 127.176127] ? kthread_associate_blkcg+0x90/0x90
[ 127.176129] ret_from_fork+0x1f/0x30
[ 127.176130] Code: ff 31 c0 c3 48 89 fe 31 c0 48 c7 c7 60 19 a9 81 e8 3a 33 d0
ff 0f ff 31 c0 c3 48 89 fe 31 c0 48 c7 c7 20 19 a9 81 e8 24 33 d0 ff <0f> ff 31
c0 c3 48 89 fe 31 c0 48 c7 c7 e8 18 a9 81 e8 0e 33 d0
[ 127.176145] ---[ end trace e7e378e0f32966e0 ]---
[ 127.176148] scsi 9:0:0:0: alua: Detached
[ 127.466362] BUG: unable to handle kernel NULL pointer dereference at
(null)
[ 127.474355] IP: _raw_spin_lock_irqsave+0x1e/0x40
[ 127.479136] PGD 399e70067 P4D 399e70067 PUD 3966cd067 PMD 0
[ 127.484961] Oops: 0002 [#1] SMP
[ 127.488269] Modules linked in: iscsi_tcp libiscsi_tcp rpcrdma ib_isert
iscsi_target_mod libiscsi scsi_transport_iscsi ib_srpt target_core_mod ib_srp
scsi_transport_srp ib_ipoib rdma_ucm ib_ucm ib_uverbs ib_umad rdma_cm ib_cm
iw_cm libcxgb mlx5_ib ext4 ib_core dm_mirror dm_region_hash dm_log dm_mod
mbcache jbd2 coretemp kvm iTCO_wdt ppdev irqbypass iTCO_vendor_support gpio_ich
i2c_i801 pcspkr lpc_ich parport_pc i5400_edac sg parport i5k_amb shpchp nfsd
auth_rpcgss nfs_acl lockd grace sunrpc ip_tables xfs libcrc32c sr_mod nouveau
cdrom sd_mod ata_generic pata_acpi video mxm_wmi wmi drm_kms_helper syscopyarea
sysfillrect sysimgblt fb_sys_fops ttm mlx5_core drm igb cxgb4 ahci firewire_ohci
ata_piix libahci firewire_core dca i2c_algo_bit devlink libata ptp serio_raw
i2c_core crc_itu_t pps_core [last unloaded: ib_iser]
[ 127.565494] CPU: 0 PID: 374 Comm: kworker/u16:5 Tainted: G W
4.15.0-rc1+ #6
[ 127.573846] Hardware name: Supermicro X7DWA/X7DWA, BIOS 6.00 12/21/2007
[ 127.580649] Workqueue: scsi_wq_8 __iscsi_unbind_session
[scsi_transport_iscsi]
[ 127.588054] task: ffff88039a4995c0 task.stack: ffffc90002888000
[ 127.594138] RIP: 0010:_raw_spin_lock_irqsave+0x1e/0x40
[ 127.599433] RSP: 0018:ffffc9000288bd68 EFLAGS: 00010046
[ 127.604819] RAX: 0000000000000000 RBX: 0000000000000246 RCX: 0000000000000000
[ 127.612129] RDX: 0000000000000001 RSI: ffff8803bfc0e038 RDI: 0000000000000000
[ 127.619427] RBP: ffff880396700f28 R08: 0000000000000000 R09: 0000000000000496
[ 127.626768] R10: 0000000000000000 R11: 0000000000000010 R12: ffff88033ab43900
[ 127.634067] R13: ffff88033997f000 R14: ffff880396700800 R15: ffff88033997f000
[ 127.641390] FS: 0000000000000000(0000) GS:ffff8803bfc00000(0000)
knlGS:0000000000000000
[ 127.649667] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 127.655579] CR2: 0000000000000000 CR3: 0000000396042000 CR4: 00000000000006f0
[ 127.662890] Call Trace:
[ 127.665521] scsi_device_dev_release_usercontext+0x40/0x230
[ 127.671273] execute_in_process_context+0x58/0x60
[ 127.676144] device_release+0x2d/0x80
[ 127.679987] kobject_cleanup+0x5e/0x180
[ 127.684005] scsi_remove_target+0x16b/0x1b0
[ 127.688356] __iscsi_unbind_session+0xb3/0x160 [scsi_transport_iscsi]
[ 127.694972] process_one_work+0x141/0x340
[ 127.699179] worker_thread+0x47/0x3e0
[ 127.703018] kthread+0xf5/0x130
[ 127.706330] ? rescuer_thread+0x380/0x380
[ 127.710504] ? kthread_associate_blkcg+0x90/0x90
[ 127.715321] ret_from_fork+0x1f/0x30
[ 127.719083] Code: f4 66 90 66 2e 0f 1f 84 00 00 00 00 00 66 66 66 66 90 53 9c
58 66 66 90 66 90 48 89 c3 fa 66 66 90 66 66 90 31 c0 ba 01 00 00 00 <f0> 0f b1
17 85 c0 75 05 48 89 d8 5b c3 89 c6 e8 77 63 98 ff eb
[ 127.738870] RIP: _raw_spin_lock_irqsave+0x1e/0x40 RSP: ffffc9000288bd68
[ 127.745673] CR2: 0000000000000000
next reply other threads:[~2017-12-01 17:07 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-12-01 17:00 Steve Wise [this message]
2017-12-01 18:32 ` crash in iscsi/scsi initiator with linux-4.15.0-rc1 Ewan D. Milne
2017-12-01 20:36 ` Steve Wise
2017-12-19 19:31 ` Steve Wise
2017-12-19 20:20 ` Ewan D. Milne
2017-12-20 19:05 ` Steve Wise
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='000201d36ac5$dc96d390$95c47ab0$@opengridcomputing.com' \
--to=swise@opengridcomputing.com \
--cc=linux-scsi@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).