iscsi-target: Fix iscsit_free_cmd() se_cmd->cmd_kref shutdown handling
With the introduction of target_get_sess_cmd() referencing counting for
ISCSI_OP_SCSI_CMD processing with iser-target, iscsit_free_cmd() usage
in traditional iscsi-target driver code now needs to be aware of the
active I/O shutdown case when a remaining se_cmd->cmd_kref reference may
exist after transport_generic_free_cmd() completes, requiring a final
target_put_sess_cmd() to release iscsi_cmd descriptor memory.
This patch changes iscsit_free_cmd() to invoke __iscsit_free_cmd() before
transport_generic_free_cmd() -> target_put_sess_cmd(), and also avoids
aquiring the per-connection queue locks for typical fast-path calls
during normal ISTATE_REMOVE operation.
Also update iscsit_free_cmd() usage throughout iscsi-target to
use the new 'bool shutdown' parameter.
This patch fixes a regression bug introduced during v3.10-rc1 in
commit 3e1c81a95, that was causing the following WARNING to appear:
[ 257.235153] ------------[ cut here]------------
[ 257.240314] WARNING: at kernel/softirq.c:160 local_bh_enable_ip+0x3c/0x86()
[ 257.248089] Modules linked in: vhost_scsi ib_srpt ib_cm ib_sa ib_mad ib_core tcm_qla2xxx tcm_loop
tcm_fc libfc iscsi_target_mod target_core_pscsi target_core_file
target_core_iblock target_core_mod configfs ipv6 iscsi_tcp libiscsi_tcp
libiscsi scsi_transport_iscsi loop acpi_cpufreq freq_table mperf
kvm_intel kvm crc32c_intel button ehci_pci pcspkr joydev i2c_i801
microcode ext3 jbd raid10 raid456 async_pq async_xor xor async_memcpy
async_raid6_recov raid6_pq async_tx raid1 raid0 linear igb hwmon
i2c_algo_bit i2c_core ptp ata_piix libata qla2xxx uhci_hcd ehci_hcd
mlx4_core scsi_transport_fc scsi_tgt pps_core
[ 257.308748] CPU: 1 PID: 3295 Comm: iscsi_ttx Not tainted 3.10.0-rc2+ #103
[ 257.316329] Hardware name: Intel Corporation S5520HC/S5520HC, BIOS S5500.86B.01.00.0057.031020111721 03/10/2011
[ 257.327597] ffffffff814c24b7 ffff880458331b58 ffffffff8138eef2 ffff880458331b98
[ 257.335892] ffffffff8102c052 ffff880400000008 0000000000000000 ffff88085bdf0000
[ 257.344191] ffff88085bdf00d8 ffff88085bdf00e0 ffff88085bdf00f8 ffff880458331ba8
[ 257.352488] Call Trace:
[ 257.355223] [<ffffffff8138eef2>] dump_stack+0x19/0x1f
[ 257.360963] [<ffffffff8102c052>] warn_slowpath_common+0x62/0x7b
[ 257.367669] [<ffffffff8102c080>] warn_slowpath_null+0x15/0x17
[ 257.374181] [<ffffffff81032345>] local_bh_enable_ip+0x3c/0x86
[ 257.380697] [<ffffffff813917fd>] _raw_spin_unlock_bh+0x10/0x12
[ 257.387311] [<ffffffffa029069c>] iscsit_free_r2ts_from_list+0x5e/0x67 [iscsi_target_mod]
[ 257.396438] [<ffffffffa02906c5>] iscsit_release_cmd+0x20/0x223 [iscsi_target_mod]
[ 257.404893] [<ffffffffa02977a4>] lio_release_cmd+0x3a/0x3e [iscsi_target_mod]
[ 257.412964] [<ffffffffa01d59a1>] target_release_cmd_kref+0x7a/0x7c [target_core_mod]
[ 257.421712] [<ffffffffa01d69bc>] target_put_sess_cmd+0x5f/0x7f [target_core_mod]
[ 257.430071] [<ffffffffa01d6d6d>] transport_release_cmd+0x59/0x6f [target_core_mod]
[ 257.438625] [<ffffffffa01d6eb4>] transport_put_cmd+0x131/0x140 [target_core_mod]
[ 257.446985] [<ffffffffa01d6192>] ? transport_wait_for_tasks+0xfa/0x1d5 [target_core_mod]
[ 257.456121] [<ffffffffa01d6f11>] transport_generic_free_cmd+0x4e/0x52 [target_core_mod]
[ 257.465159] [<ffffffff81050537>] ? __migrate_task+0x110/0x110
[ 257.471674] [<ffffffffa02904ba>] iscsit_free_cmd+0x46/0x55 [iscsi_target_mod]
[ 257.479741] [<ffffffffa0291edb>] iscsit_immediate_queue+0x301/0x353 [iscsi_target_mod]
[ 257.488683] [<ffffffffa0292f7e>] iscsi_target_tx_thread+0x1c6/0x2a8 [iscsi_target_mod]
[ 257.497623] [<ffffffff81047486>] ? wake_up_bit+0x25/0x25
[ 257.503652] [<ffffffffa0292db8>] ? iscsit_ack_from_expstatsn+0xd5/0xd5 [iscsi_target_mod]
[ 257.512882] [<ffffffff81046f89>] kthread+0xb0/0xb8
[ 257.518329] [<ffffffff81046ed9>] ? kthread_freezable_should_stop+0x60/0x60
[ 257.526105] [<ffffffff81396fec>] ret_from_fork+0x7c/0xb0
[ 257.532133] [<ffffffff81046ed9>] ? kthread_freezable_should_stop+0x60/0x60
[ 257.539906] ---[ end trace 5520397d0f2e0800 ]---
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
This commit is contained in:
Nicholas Bellinger
parent
d5ddad4168
commit
aafc9d158b
|
|
@ -651,7 +651,7 @@ static int iscsit_add_reject(
|
|||
cmd->buf_ptr = kmemdup(buf, ISCSI_HDR_LEN, GFP_KERNEL);
|
||||
if (!cmd->buf_ptr) {
|
||||
pr_err("Unable to allocate memory for cmd->buf_ptr\n");
|
||||
iscsit_release_cmd(cmd);
|
||||
iscsit_free_cmd(cmd, false);
|
||||
return -1;
|
||||
}
|
||||
|
||||
|
|
@ -697,7 +697,7 @@ int iscsit_add_reject_from_cmd(
|
|||
cmd->buf_ptr = kmemdup(buf, ISCSI_HDR_LEN, GFP_KERNEL);
|
||||
if (!cmd->buf_ptr) {
|
||||
pr_err("Unable to allocate memory for cmd->buf_ptr\n");
|
||||
iscsit_release_cmd(cmd);
|
||||
iscsit_free_cmd(cmd, false);
|
||||
return -1;
|
||||
}
|
||||
|
||||
|
|
@ -1743,7 +1743,7 @@ int iscsit_handle_nop_out(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
|
|||
return 0;
|
||||
out:
|
||||
if (cmd)
|
||||
iscsit_release_cmd(cmd);
|
||||
iscsit_free_cmd(cmd, false);
|
||||
ping_out:
|
||||
kfree(ping_data);
|
||||
return ret;
|
||||
|
|
@ -2251,7 +2251,7 @@ iscsit_handle_logout_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
|
|||
if (conn->conn_state != TARG_CONN_STATE_LOGGED_IN) {
|
||||
pr_err("Received logout request on connection that"
|
||||
" is not in logged in state, ignoring request.\n");
|
||||
iscsit_release_cmd(cmd);
|
||||
iscsit_free_cmd(cmd, false);
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
|
@ -3665,7 +3665,7 @@ iscsit_immediate_queue(struct iscsi_conn *conn, struct iscsi_cmd *cmd, int state
|
|||
list_del(&cmd->i_conn_node);
|
||||
spin_unlock_bh(&conn->cmd_lock);
|
||||
|
||||
iscsit_free_cmd(cmd);
|
||||
iscsit_free_cmd(cmd, false);
|
||||
break;
|
||||
case ISTATE_SEND_NOPIN_WANT_RESPONSE:
|
||||
iscsit_mod_nopin_response_timer(conn);
|
||||
|
|
@ -4122,7 +4122,7 @@ static void iscsit_release_commands_from_conn(struct iscsi_conn *conn)
|
|||
|
||||
iscsit_increment_maxcmdsn(cmd, sess);
|
||||
|
||||
iscsit_free_cmd(cmd);
|
||||
iscsit_free_cmd(cmd, true);
|
||||
|
||||
spin_lock_bh(&conn->cmd_lock);
|
||||
}
|
||||
|
|
|
|||
|
|
@ -143,7 +143,7 @@ void iscsit_free_connection_recovery_entires(struct iscsi_session *sess)
|
|||
list_del(&cmd->i_conn_node);
|
||||
cmd->conn = NULL;
|
||||
spin_unlock(&cr->conn_recovery_cmd_lock);
|
||||
iscsit_free_cmd(cmd);
|
||||
iscsit_free_cmd(cmd, true);
|
||||
spin_lock(&cr->conn_recovery_cmd_lock);
|
||||
}
|
||||
spin_unlock(&cr->conn_recovery_cmd_lock);
|
||||
|
|
@ -165,7 +165,7 @@ void iscsit_free_connection_recovery_entires(struct iscsi_session *sess)
|
|||
list_del(&cmd->i_conn_node);
|
||||
cmd->conn = NULL;
|
||||
spin_unlock(&cr->conn_recovery_cmd_lock);
|
||||
iscsit_free_cmd(cmd);
|
||||
iscsit_free_cmd(cmd, true);
|
||||
spin_lock(&cr->conn_recovery_cmd_lock);
|
||||
}
|
||||
spin_unlock(&cr->conn_recovery_cmd_lock);
|
||||
|
|
@ -248,7 +248,7 @@ void iscsit_discard_cr_cmds_by_expstatsn(
|
|||
iscsit_remove_cmd_from_connection_recovery(cmd, sess);
|
||||
|
||||
spin_unlock(&cr->conn_recovery_cmd_lock);
|
||||
iscsit_free_cmd(cmd);
|
||||
iscsit_free_cmd(cmd, true);
|
||||
spin_lock(&cr->conn_recovery_cmd_lock);
|
||||
}
|
||||
spin_unlock(&cr->conn_recovery_cmd_lock);
|
||||
|
|
@ -302,7 +302,7 @@ int iscsit_discard_unacknowledged_ooo_cmdsns_for_conn(struct iscsi_conn *conn)
|
|||
list_del(&cmd->i_conn_node);
|
||||
|
||||
spin_unlock_bh(&conn->cmd_lock);
|
||||
iscsit_free_cmd(cmd);
|
||||
iscsit_free_cmd(cmd, true);
|
||||
spin_lock_bh(&conn->cmd_lock);
|
||||
}
|
||||
spin_unlock_bh(&conn->cmd_lock);
|
||||
|
|
@ -355,7 +355,7 @@ int iscsit_prepare_cmds_for_realligance(struct iscsi_conn *conn)
|
|||
|
||||
list_del(&cmd->i_conn_node);
|
||||
spin_unlock_bh(&conn->cmd_lock);
|
||||
iscsit_free_cmd(cmd);
|
||||
iscsit_free_cmd(cmd, true);
|
||||
spin_lock_bh(&conn->cmd_lock);
|
||||
continue;
|
||||
}
|
||||
|
|
@ -375,7 +375,7 @@ int iscsit_prepare_cmds_for_realligance(struct iscsi_conn *conn)
|
|||
iscsi_sna_gte(cmd->cmd_sn, conn->sess->exp_cmd_sn)) {
|
||||
list_del(&cmd->i_conn_node);
|
||||
spin_unlock_bh(&conn->cmd_lock);
|
||||
iscsit_free_cmd(cmd);
|
||||
iscsit_free_cmd(cmd, true);
|
||||
spin_lock_bh(&conn->cmd_lock);
|
||||
continue;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -676,40 +676,56 @@ void iscsit_free_queue_reqs_for_conn(struct iscsi_conn *conn)
|
|||
|
||||
void iscsit_release_cmd(struct iscsi_cmd *cmd)
|
||||
{
|
||||
struct iscsi_conn *conn = cmd->conn;
|
||||
|
||||
iscsit_free_r2ts_from_list(cmd);
|
||||
iscsit_free_all_datain_reqs(cmd);
|
||||
|
||||
kfree(cmd->buf_ptr);
|
||||
kfree(cmd->pdu_list);
|
||||
kfree(cmd->seq_list);
|
||||
kfree(cmd->tmr_req);
|
||||
kfree(cmd->iov_data);
|
||||
|
||||
if (conn) {
|
||||
iscsit_remove_cmd_from_immediate_queue(cmd, conn);
|
||||
iscsit_remove_cmd_from_response_queue(cmd, conn);
|
||||
}
|
||||
|
||||
kmem_cache_free(lio_cmd_cache, cmd);
|
||||
}
|
||||
|
||||
void iscsit_free_cmd(struct iscsi_cmd *cmd)
|
||||
static void __iscsit_free_cmd(struct iscsi_cmd *cmd, bool scsi_cmd,
|
||||
bool check_queues)
|
||||
{
|
||||
struct iscsi_conn *conn = cmd->conn;
|
||||
|
||||
if (scsi_cmd) {
|
||||
if (cmd->data_direction == DMA_TO_DEVICE) {
|
||||
iscsit_stop_dataout_timer(cmd);
|
||||
iscsit_free_r2ts_from_list(cmd);
|
||||
}
|
||||
if (cmd->data_direction == DMA_FROM_DEVICE)
|
||||
iscsit_free_all_datain_reqs(cmd);
|
||||
}
|
||||
|
||||
if (conn && check_queues) {
|
||||
iscsit_remove_cmd_from_immediate_queue(cmd, conn);
|
||||
iscsit_remove_cmd_from_response_queue(cmd, conn);
|
||||
}
|
||||
}
|
||||
|
||||
void iscsit_free_cmd(struct iscsi_cmd *cmd, bool shutdown)
|
||||
{
|
||||
struct se_cmd *se_cmd = NULL;
|
||||
int rc;
|
||||
/*
|
||||
* Determine if a struct se_cmd is associated with
|
||||
* this struct iscsi_cmd.
|
||||
*/
|
||||
switch (cmd->iscsi_opcode) {
|
||||
case ISCSI_OP_SCSI_CMD:
|
||||
if (cmd->data_direction == DMA_TO_DEVICE)
|
||||
iscsit_stop_dataout_timer(cmd);
|
||||
se_cmd = &cmd->se_cmd;
|
||||
__iscsit_free_cmd(cmd, true, shutdown);
|
||||
/*
|
||||
* Fallthrough
|
||||
*/
|
||||
case ISCSI_OP_SCSI_TMFUNC:
|
||||
transport_generic_free_cmd(&cmd->se_cmd, 1);
|
||||
rc = transport_generic_free_cmd(&cmd->se_cmd, 1);
|
||||
if (!rc && shutdown && se_cmd && se_cmd->se_sess) {
|
||||
__iscsit_free_cmd(cmd, true, shutdown);
|
||||
target_put_sess_cmd(se_cmd->se_sess, se_cmd);
|
||||
}
|
||||
break;
|
||||
case ISCSI_OP_REJECT:
|
||||
/*
|
||||
|
|
@ -718,11 +734,19 @@ void iscsit_free_cmd(struct iscsi_cmd *cmd)
|
|||
* associated cmd->se_cmd needs to be released.
|
||||
*/
|
||||
if (cmd->se_cmd.se_tfo != NULL) {
|
||||
transport_generic_free_cmd(&cmd->se_cmd, 1);
|
||||
se_cmd = &cmd->se_cmd;
|
||||
__iscsit_free_cmd(cmd, true, shutdown);
|
||||
|
||||
rc = transport_generic_free_cmd(&cmd->se_cmd, 1);
|
||||
if (!rc && shutdown && se_cmd->se_sess) {
|
||||
__iscsit_free_cmd(cmd, true, shutdown);
|
||||
target_put_sess_cmd(se_cmd->se_sess, se_cmd);
|
||||
}
|
||||
break;
|
||||
}
|
||||
/* Fall-through */
|
||||
default:
|
||||
__iscsit_free_cmd(cmd, false, shutdown);
|
||||
cmd->release_cmd(cmd);
|
||||
break;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -29,7 +29,7 @@ extern void iscsit_remove_cmd_from_tx_queues(struct iscsi_cmd *, struct iscsi_co
|
|||
extern bool iscsit_conn_all_queues_empty(struct iscsi_conn *);
|
||||
extern void iscsit_free_queue_reqs_for_conn(struct iscsi_conn *);
|
||||
extern void iscsit_release_cmd(struct iscsi_cmd *);
|
||||
extern void iscsit_free_cmd(struct iscsi_cmd *);
|
||||
extern void iscsit_free_cmd(struct iscsi_cmd *, bool);
|
||||
extern int iscsit_check_session_usage_count(struct iscsi_session *);
|
||||
extern void iscsit_dec_session_usage_count(struct iscsi_session *);
|
||||
extern void iscsit_inc_session_usage_count(struct iscsi_session *);
|
||||
|
|
|
|||
Loading…
Reference in New Issue