From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-io1-f68.google.com ([209.85.166.68]:35530 "EHLO mail-io1-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725759AbeKOBXw (ORCPT ); Wed, 14 Nov 2018 20:23:52 -0500 Received: by mail-io1-f68.google.com with SMTP id u19so7719764ioc.2 for ; Wed, 14 Nov 2018 07:20:13 -0800 (PST) Subject: Re: [PATCH V2] SCSI: fix queue cleanup race before queue initialization is done To: Ming Lei Cc: linux-block@vger.kernel.org, Andrew Jones , Bart Van Assche , linux-scsi@vger.kernel.org, "Martin K . Petersen" , Christoph Hellwig , "James E . J . Bottomley" , stable , "jianchao . wang" References: <20181114082551.12141-1-ming.lei@redhat.com> From: Jens Axboe Message-ID: <63c063ad-7d74-4268-bfd4-2de89908949e@kernel.dk> Date: Wed, 14 Nov 2018 08:20:09 -0700 MIME-Version: 1.0 In-Reply-To: <20181114082551.12141-1-ming.lei@redhat.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Sender: stable-owner@vger.kernel.org List-ID: On 11/14/18 1:25 AM, Ming Lei wrote: > c2856ae2f315d ("blk-mq: quiesce queue before freeing queue") has > already fixed this race, however the implied synchronize_rcu() > in blk_mq_quiesce_queue() can slow down LUN probe a lot, so caused > performance regression. > > Then 1311326cf4755c7 ("blk-mq: avoid to synchronize rcu inside blk_cleanup_queue()") > tried to quiesce queue for avoiding unnecessary synchronize_rcu() > only when queue initialization is done, because it is usual to see > lots of inexistent LUNs which need to be probed. > > However, turns out it isn't safe to quiesce queue only when queue > initialization is done. Because when one SCSI command is completed, > the user of sending command can be waken up immediately, then the > scsi device may be removed, meantime the run queue in scsi_end_request() > is still in-progress, so kernel panic can be caused. > > In Red Hat QE lab, there are several reports about this kind of kernel > panic triggered during kernel booting. > > This patch tries to address the issue by grabing one queue usage > counter during freeing one request and the following run queue. Thanks applied, this bug was elusive but ever present in recent testing that we did internally, it's been a huge pain in the butt. The symptoms were usually a crash in blk_mq_get_driver_tag() with hctx->tags == NULL, or a crash inside deadline request insert off requeue. -- Jens Axboe