From: Dan Williams <dan.j.williams@intel.com>
To: linux-scsi@vger.kernel.org
Cc: linux-ide@vger.kernel.org
Subject: [PATCH 04/18] scsi_transport_sas: fix delete vs scan race
Date: Sun, 06 May 2012 11:18:17 -0700 [thread overview]
Message-ID: <20120506181817.17912.17194.stgit@dwillia2-linux.jf.intel.com> (raw)
In-Reply-To: <20120506181611.17912.3798.stgit@dwillia2-linux.jf.intel.com>
The following crash results from cases where the end_device has been
removed before scsi_sysfs_add_sdev has had a chance to run.
BUG: unable to handle kernel NULL pointer dereference at 0000000000000098
IP: [<ffffffff8115e100>] sysfs_create_dir+0x32/0xb6
...
Call Trace:
[<ffffffff8125e4a8>] kobject_add_internal+0x120/0x1e3
[<ffffffff81075149>] ? trace_hardirqs_on+0xd/0xf
[<ffffffff8125e641>] kobject_add_varg+0x41/0x50
[<ffffffff8125e70b>] kobject_add+0x64/0x66
[<ffffffff8131122b>] device_add+0x12d/0x63a
[<ffffffff814b65ea>] ? _raw_spin_unlock_irqrestore+0x47/0x56
[<ffffffff8107de15>] ? module_refcount+0x89/0xa0
[<ffffffff8132f348>] scsi_sysfs_add_sdev+0x4e/0x28a
[<ffffffff8132dcbb>] do_scan_async+0x9c/0x145
...teach sas_rphy_remove to wait for async scanning to quiesce before
removing the end_device. It seems this is a more general problem [1],
but this patch only addresses sas transport.
[1]: 23edb6e [SCSI] mpt2sas: Do not set sas_device->starget to NULL from
the slave_destroy callback when all the LUNS have been deleted
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
---
drivers/scsi/scsi_transport_sas.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/scsi/scsi_transport_sas.c b/drivers/scsi/scsi_transport_sas.c
index f7565fc..47abb90 100644
--- a/drivers/scsi/scsi_transport_sas.c
+++ b/drivers/scsi/scsi_transport_sas.c
@@ -33,8 +33,9 @@
#include <linux/bsg.h>
#include <scsi/scsi.h>
-#include <scsi/scsi_device.h>
#include <scsi/scsi_host.h>
+#include <scsi/scsi_scan.h>
+#include <scsi/scsi_device.h>
#include <scsi/scsi_transport.h>
#include <scsi/scsi_transport_sas.h>
@@ -1667,6 +1668,9 @@ sas_rphy_remove(struct sas_rphy *rphy)
{
struct device *dev = &rphy->dev;
+ /* prevent device_del() while child device_add() may be in-flight */
+ scsi_complete_async_scans();
+
switch (rphy->identify.device_type) {
case SAS_END_DEVICE:
scsi_remove_target(dev);
next prev parent reply other threads:[~2012-05-06 18:18 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-05-06 18:17 [PATCH 00/18] libsas, sas_ata: update for 3.5 Dan Williams
2012-05-06 18:18 ` [PATCH 01/18] libsas: cleanup spurious calls to scsi_schedule_eh Dan Williams
2012-05-06 18:18 ` [PATCH 02/18] libata, libsas: introduce sched_eh and end_eh port ops Dan Williams
2012-05-06 18:18 ` [PATCH 03/18] scsi: fix eh wakeup (scsi_schedule_eh vs scsi_restart_operations) Dan Williams
2012-05-06 18:18 ` Dan Williams [this message]
2012-05-06 18:18 ` [PATCH 05/18] libsas: enforce eh strategy handlers only in eh context Dan Williams
2012-05-06 18:18 ` [PATCH 06/18] libsas: add sas_eh_abort_handler Dan Williams
2012-05-06 18:18 ` [PATCH 07/18] libsas: use ->lldd_I_T_nexus_reset for ->eh_bus_reset_handler Dan Williams
2012-05-06 18:18 ` [PATCH 08/18] isci: use sas eh strategy handlers Dan Williams
2012-05-06 18:18 ` [PATCH 09/18] libsas: trim sas_task of slow path infrastructure Dan Williams
2012-05-06 18:18 ` [PATCH 10/18] libsas: sas_rediscover_dev did not look at the SMP exec status Dan Williams
2012-05-06 18:18 ` [PATCH 11/18] mvsas: remove unused variable in mvs_task_exec() Dan Williams
2012-05-06 18:18 ` [PATCH 12/18] libata: reset once Dan Williams
2012-05-06 18:19 ` [PATCH 13/18] libsas: continue revalidation Dan Williams
2012-05-06 18:19 ` [PATCH 14/18] libata: export ata_port suspend/resume infrastructure for sas Dan Williams
2012-05-06 18:19 ` [PATCH 15/18] libsas: drop sata port multiplier infrastructure Dan Williams
2012-05-06 18:19 ` [PATCH 16/18] scsi, sd: limit the scope of the async probe domain Dan Williams
2012-05-06 18:19 ` [PATCH 17/18] libsas: suspend / resume support Dan Williams
2012-05-06 18:19 ` [PATCH 18/18] scsi: cleanup setting task state in scsi_error_handler() Dan Williams
2012-05-31 18:12 ` [PATCH 00/18] libsas, sas_ata: update for 3.5 Dan Williams
2012-06-01 4:50 ` Jack Wang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20120506181817.17912.17194.stgit@dwillia2-linux.jf.intel.com \
--to=dan.j.williams@intel.com \
--cc=linux-ide@vger.kernel.org \
--cc=linux-scsi@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).