Re: [Qemu-devel] [PATCH] iscsi: fix race between task completition and task abortion

[Stefan Hajnoczi <stefanha@gmail.com>]

On Tue, Aug 14, 2012 at 08:44:46AM +0200, Stefan Priebe wrote:
> From: spriebe <git@profihost.ag>

CCing Ronnie, iSCSI block driver author.

> 
> ---
>  block/iscsi.c |   36 ++++++++++++++++++++----------------
>  1 files changed, 20 insertions(+), 16 deletions(-)
> 
> diff --git a/block/iscsi.c b/block/iscsi.c
> index 12ca76d..257f97f 100644
> --- a/block/iscsi.c
> +++ b/block/iscsi.c
> @@ -76,6 +76,10 @@ static void
>  iscsi_abort_task_cb(struct iscsi_context *iscsi, int status, void *command_data,
>                      void *private_data)
>  {
> +           IscsiAIOCB *acb = (IscsiAIOCB *)private_data;
> +
> +           scsi_free_scsi_task(acb->task);
> +           acb->task = NULL;
>  }
>  
>  static void
> @@ -85,14 +89,19 @@ iscsi_aio_cancel(BlockDriverAIOCB *blockacb)
>      IscsiLun *iscsilun = acb->iscsilun;
>  
>      acb->common.cb(acb->common.opaque, -ECANCELED);
> -    acb->canceled = 1;
>  
> -    /* send a task mgmt call to the target to cancel the task on the target */
> -    iscsi_task_mgmt_abort_task_async(iscsilun->iscsi, acb->task,
> -                                     iscsi_abort_task_cb, NULL);
> +    if (acb->canceled != 0)
> +        return;
> +
> +    acb->canceled = 1;
>  
> -    /* then also cancel the task locally in libiscsi */
> -    iscsi_scsi_task_cancel(iscsilun->iscsi, acb->task);
> +    /* send a task mgmt call to the target to cancel the task on the target
> +     * this also cancels the task in libiscsi
> +     */
> +    if (acb->task) {
> +        iscsi_task_mgmt_abort_task_async(iscsilun->iscsi, acb->task,
> +                                         iscsi_abort_task_cb, &acb);
> +    }
>  }
>  
>  static AIOPool iscsi_aio_pool = {
> @@ -184,6 +193,11 @@ iscsi_readv_writev_bh_cb(void *p)
>      }
>  
>      qemu_aio_release(acb);
> +
> +    if (acb->task) {
> +      scsi_free_scsi_task(acb->task);
> +      acb->task = NULL;
> +    }
>  }
>  
>  
> @@ -212,8 +226,6 @@ iscsi_aio_write16_cb(struct iscsi_context *iscsi, int status,
>      }
>  
>      iscsi_schedule_bh(iscsi_readv_writev_bh_cb, acb);
> -    scsi_free_scsi_task(acb->task);
> -    acb->task = NULL;
>  }
>  
>  static int64_t sector_qemu2lun(int64_t sector, IscsiLun *iscsilun)
> @@ -313,8 +325,6 @@ iscsi_aio_read16_cb(struct iscsi_context *iscsi, int status,
>      }
>  
>      iscsi_schedule_bh(iscsi_readv_writev_bh_cb, acb);
> -    scsi_free_scsi_task(acb->task);
> -    acb->task = NULL;
>  }
>  
>  static BlockDriverAIOCB *
> @@ -429,8 +439,6 @@ iscsi_synccache10_cb(struct iscsi_context *iscsi, int status,
>      }
>  
>      iscsi_schedule_bh(iscsi_readv_writev_bh_cb, acb);
> -    scsi_free_scsi_task(acb->task);
> -    acb->task = NULL;
>  }
>  
>  static BlockDriverAIOCB *
> @@ -483,8 +491,6 @@ iscsi_unmap_cb(struct iscsi_context *iscsi, int status,
>      }
>  
>      iscsi_schedule_bh(iscsi_readv_writev_bh_cb, acb);
> -    scsi_free_scsi_task(acb->task);
> -    acb->task = NULL;
>  }
>  
>  static BlockDriverAIOCB *
> @@ -560,8 +566,6 @@ iscsi_aio_ioctl_cb(struct iscsi_context *iscsi, int status,
>      }
>  
>      iscsi_schedule_bh(iscsi_readv_writev_bh_cb, acb);
> -    scsi_free_scsi_task(acb->task);
> -    acb->task = NULL;
>  }
>  
>  static BlockDriverAIOCB *iscsi_aio_ioctl(BlockDriverState *bs,
> -- 
> 1.7.2.5
> 
>