Anoob Soman
4cd31be45a
scsi: libiscsi: Fix race between iscsi_xmit_task and iscsi_complete_task
[ Upstream commit 79edd00dc6 ]
When a target sends Check Condition, whilst initiator is busy xmiting
re-queued data, could lead to race between iscsi_complete_task() and
iscsi_xmit_task() and eventually crashing with the following kernel
backtrace.
[3326150.987523] ALERT: BUG: unable to handle kernel NULL pointer dereference at 0000000000000078
[3326150.987549] ALERT: IP: [<ffffffffa05ce70d>] iscsi_xmit_task+0x2d/0xc0 [libiscsi]
[3326150.987571] WARN: PGD 569c8067 PUD 569c9067 PMD 0
[3326150.987582] WARN: Oops: 0002 [#1] SMP
[3326150.987593] WARN: Modules linked in: tun nfsv3 nfs fscache dm_round_robin
[3326150.987762] WARN: CPU: 2 PID: 8399 Comm: kworker/u32:1 Tainted: G O 4.4.0+2 #1
[3326150.987774] WARN: Hardware name: Dell Inc. PowerEdge R720/0W7JN5, BIOS 2.5.4 01/22/2016
[3326150.987790] WARN: Workqueue: iscsi_q_13 iscsi_xmitworker [libiscsi]
[3326150.987799] WARN: task: ffff8801d50f3800 ti: ffff8801f5458000 task.ti: ffff8801f5458000
[3326150.987810] WARN: RIP: e030:[<ffffffffa05ce70d>] [<ffffffffa05ce70d>] iscsi_xmit_task+0x2d/0xc0 [libiscsi]
[3326150.987825] WARN: RSP: e02b:ffff8801f545bdb0 EFLAGS: 00010246
[3326150.987831] WARN: RAX: 00000000ffffffc3 RBX: ffff880282d2ab20 RCX: ffff88026b6ac480
[3326150.987842] WARN: RDX: 0000000000000000 RSI: 00000000fffffe01 RDI: ffff880282d2ab20
[3326150.987852] WARN: RBP: ffff8801f545bdc8 R08: 0000000000000000 R09: 0000000000000008
[3326150.987862] WARN: R10: 0000000000000000 R11: 000000000000fe88 R12: 0000000000000000
[3326150.987872] WARN: R13: ffff880282d2abe8 R14: ffff880282d2abd8 R15: ffff880282d2ac08
[3326150.987890] WARN: FS: 00007f5a866b4840(0000) GS:ffff88028a640000(0000) knlGS:0000000000000000
[3326150.987900] WARN: CS: e033 DS: 0000 ES: 0000 CR0: 0000000080050033
[3326150.987907] WARN: CR2: 0000000000000078 CR3: 0000000070244000 CR4: 0000000000042660
[3326150.987918] WARN: Stack:
[3326150.987924] WARN: ffff880282d2ad58 ffff880282d2ab20 ffff880282d2abe8 ffff8801f545be18
[3326150.987938] WARN: ffffffffa05cea90 ffff880282d2abf8 ffff88026b59cc80 ffff88026b59cc00
[3326150.987951] WARN: ffff88022acf32c0 ffff880289491800 ffff880255a80800 0000000000000400
[3326150.987964] WARN: Call Trace:
[3326150.987975] WARN: [<ffffffffa05cea90>] iscsi_xmitworker+0x2f0/0x360 [libiscsi]
[3326150.987988] WARN: [<ffffffff8108862c>] process_one_work+0x1fc/0x3b0
[3326150.987997] WARN: [<ffffffff81088f95>] worker_thread+0x2a5/0x470
[3326150.988006] WARN: [<ffffffff8159cad8>] ? __schedule+0x648/0x870
[3326150.988015] WARN: [<ffffffff81088cf0>] ? rescuer_thread+0x300/0x300
[3326150.988023] WARN: [<ffffffff8108ddf5>] kthread+0xd5/0xe0
[3326150.988031] WARN: [<ffffffff8108dd20>] ? kthread_stop+0x110/0x110
[3326150.988040] WARN: [<ffffffff815a0bcf>] ret_from_fork+0x3f/0x70
[3326150.988048] WARN: [<ffffffff8108dd20>] ? kthread_stop+0x110/0x110
[3326150.988127] ALERT: RIP [<ffffffffa05ce70d>] iscsi_xmit_task+0x2d/0xc0 [libiscsi]
[3326150.988138] WARN: RSP <ffff8801f545bdb0>
[3326150.988144] WARN: CR2: 0000000000000078
[3326151.020366] WARN: ---[ end trace 1c60974d4678d81b ]---
Commit 6f8830f5bb ("scsi: libiscsi: add lock around task lists to fix
list corruption regression") introduced "taskqueuelock" to fix list
corruption during the race, but this wasn't enough.
Re-setting of conn->task to NULL, could race with iscsi_xmit_task().
iscsi_complete_task()
{
....
if (conn->task == task)
conn->task = NULL;
}
conn->task in iscsi_xmit_task() could be NULL and so will be task.
__iscsi_get_task(task) will crash (NullPtr de-ref), trying to access
refcount.
iscsi_xmit_task()
{
struct iscsi_task *task = conn->task;
__iscsi_get_task(task);
}
This commit will take extra conn->session->back_lock in iscsi_xmit_task()
to ensure iscsi_xmit_task() waits for iscsi_complete_task(), if
iscsi_complete_task() wins the race. If iscsi_xmit_task() wins the race,
iscsi_xmit_task() increments task->refcount
(__iscsi_get_task) ensuring iscsi_complete_task() will not iscsi_free_task().
Signed-off-by: Anoob Soman <anoob.soman@citrix.com>
Signed-off-by: Bob Liu <bob.liu@oracle.com>
Acked-by: Lee Duncan <lduncan@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-05-15 12:05:27 +09:00
..
2023-05-15 11:51:07 +09:00
2016-02-23 21:27:02 -05:00
2023-05-15 11:34:48 +09:00
2016-10-26 22:17:43 -04:00
2018-05-25 16:13:06 +02:00
2018-03-22 09:17:43 +01:00
2023-05-15 10:05:45 +09:00
2023-05-15 10:54:13 +09:00
2023-05-15 08:29:13 +09:00
2023-05-15 11:45:38 +09:00
2017-12-25 14:23:44 +01:00
2016-09-14 12:47:42 -04:00
2017-10-21 17:21:36 +02:00
2016-08-25 22:28:17 -04:00
2023-05-12 17:14:43 +09:00
2018-03-22 09:17:41 +01:00
2016-09-14 12:54:18 -04:00
2023-05-15 08:28:54 +09:00
2023-05-15 09:06:57 +09:00
2023-05-15 11:44:19 +09:00
2023-05-15 11:50:32 +09:00
2023-05-15 11:45:25 +09:00
2023-05-15 11:22:13 +09:00
2023-05-15 11:05:28 +09:00
2018-05-25 17:06:35 +02:00
2018-05-25 16:13:08 +02:00
2016-07-20 17:38:35 -06:00
2015-05-31 18:06:28 -07:00
2016-09-26 21:10:45 -04:00
2023-05-15 09:26:35 +09:00
2023-05-15 11:44:18 +09:00
2023-05-15 11:23:04 +09:00
2017-08-06 18:59:49 -07:00
2018-05-25 16:13:06 +02:00
2023-05-15 09:59:12 +09:00
2023-05-15 08:14:20 +09:00
2015-04-27 10:10:19 -07:00
2023-05-15 08:14:20 +09:00
2015-04-27 10:04:39 -07:00
2023-05-15 08:14:20 +09:00
2015-04-27 10:05:55 -07:00
2016-07-13 22:33:23 -04:00
2016-07-13 22:33:23 -04:00
2015-08-07 15:03:42 +02:00
2013-11-26 11:09:07 +01:00
2014-10-20 16:21:33 +02:00
2014-10-20 16:21:33 +02:00
2018-02-25 11:05:53 +01:00
2015-05-31 18:06:28 -07:00
2016-02-23 21:27:02 -05:00
2015-04-09 18:08:31 -07:00
2015-05-31 18:06:28 -07:00
2015-05-31 18:06:28 -07:00
2015-04-17 10:13:56 -07:00
2016-04-11 16:57:09 -04:00
2015-11-25 22:08:55 -05:00
2015-11-25 22:08:52 -05:00
2015-02-02 09:57:45 -08:00
2013-06-26 18:32:47 -07:00
2014-10-20 16:21:33 +02:00
2015-04-14 09:50:27 -07:00
2016-08-16 00:49:32 -04:00
2015-02-02 09:57:46 -08:00
2016-04-11 16:57:09 -04:00
2016-02-23 21:27:02 -05:00
2014-07-17 22:07:37 +02:00
2016-05-10 22:01:07 -04:00
2014-11-24 14:45:27 +01:00
2023-05-15 09:20:02 +09:00
2023-05-15 09:20:02 +09:00
2016-02-23 21:27:02 -05:00
2015-11-09 16:32:14 -08:00
2017-01-12 11:39:29 +01:00
2016-09-29 21:52:43 -04:00
2016-02-25 21:16:49 -05:00
2013-04-09 14:13:16 -04:00
2016-02-25 21:16:49 -05:00
2013-04-09 14:13:16 -04:00
2013-11-26 11:09:07 +01:00
2016-10-07 09:28:53 -07:00
2017-12-20 10:07:22 +01:00
2018-01-23 19:57:05 +01:00
2017-12-20 10:07:22 +01:00
2015-08-12 13:14:57 -07:00
2015-08-12 13:14:57 -07:00
2016-02-25 21:10:53 -05:00
2015-11-20 11:39:03 -05:00
2018-03-22 09:17:42 +01:00
2016-09-19 11:57:33 -04:00
2015-06-02 17:24:54 -07:00
2013-04-09 14:13:27 -04:00
2016-05-16 11:14:29 -04:00
2016-05-19 11:36:49 -07:00
2016-01-27 20:36:10 +08:00
2014-10-20 16:21:33 +02:00
2017-05-14 14:00:19 +02:00
2013-01-03 15:57:01 -08:00
2016-01-27 20:36:10 +08:00
2023-05-15 12:05:27 +09:00
2016-02-05 16:29:28 -06:00
2023-05-15 09:20:02 +09:00
2016-04-11 16:57:09 -04:00
2016-09-26 20:49:25 -04:00
2023-05-12 16:43:07 +09:00
2014-03-27 08:26:31 -07:00
2016-02-05 16:29:28 -06:00
2014-10-20 16:21:33 +02:00
2013-04-09 14:13:15 -04:00
2016-03-05 17:07:46 -05:00
2013-04-15 14:30:44 -06:00
2014-11-24 14:45:27 +01:00
2014-07-17 22:07:35 +02:00
2015-05-31 18:06:28 -07:00
2016-10-17 14:13:03 -04:00
2016-09-14 14:11:12 -04:00
2013-01-03 15:57:01 -08:00
2013-01-03 15:57:01 -08:00
2015-05-31 18:06:28 -07:00
2014-11-24 20:01:28 +01:00
2016-09-04 01:28:07 -04:00
2016-02-23 21:27:02 -05:00
2015-05-31 18:06:28 -07:00
2016-04-30 09:25:26 -07:00
2015-05-31 18:06:28 -07:00
2016-03-01 20:06:49 -05:00
2016-11-28 15:51:31 -05:00
2016-04-04 12:07:42 -04:00
2017-12-20 10:07:30 +01:00
2023-05-15 10:05:55 +09:00
2023-05-12 16:44:10 +09:00
2016-06-18 11:59:01 -07:00
2014-11-12 11:16:12 +01:00
2017-12-14 09:28:11 +01:00
2015-02-04 08:00:24 -08:00
2014-11-12 11:16:05 +01:00
2014-04-24 13:44:54 -04:00
2023-05-15 11:01:25 +09:00
2016-10-07 09:28:53 -07:00
2016-04-11 16:57:09 -04:00
2016-03-14 21:05:04 -04:00
2017-07-27 15:07:59 -07:00
2014-06-06 16:08:16 -07:00
2023-05-12 17:16:54 +09:00
2016-04-11 16:57:09 -04:00
2016-04-11 16:57:09 -04:00
2017-10-05 09:43:59 +02:00
2016-08-18 22:23:20 -04:00
2015-08-07 14:28:45 +02:00
2018-06-06 16:44:38 +02:00
2016-09-26 20:58:42 -04:00
2014-11-12 11:15:54 +01:00
2016-09-15 09:51:14 -04:00
2023-05-15 11:01:26 +09:00
2016-09-15 09:51:14 -04:00
2016-04-11 16:57:09 -04:00
2018-03-22 09:17:55 +01:00
2023-05-12 16:45:48 +09:00
2014-10-20 16:21:33 +02:00
2016-02-23 21:27:02 -05:00
2014-10-20 16:21:33 +02:00
2023-05-15 10:26:52 +09:00
2014-07-17 22:07:39 +02:00
2023-05-12 16:46:46 +09:00
2014-11-12 11:15:57 +01:00
2016-10-18 14:13:37 -07:00
2015-11-18 11:59:09 -05:00
2016-02-23 21:27:02 -05:00
2018-05-25 16:13:07 +02:00
2014-05-28 12:16:28 +02:00
2016-04-11 16:57:09 -04:00
2014-11-20 09:11:15 +01:00
2015-08-10 23:07:05 -04:00
2014-10-20 16:21:33 +02:00
2015-05-31 18:06:28 -07:00
2018-04-08 12:12:50 +02:00
2023-05-15 10:36:52 +09:00
2016-11-01 13:31:23 -04:00
2015-02-02 09:57:46 -08:00
2013-04-09 14:13:15 -04:00
2016-09-01 17:52:01 -07:00
2015-05-31 18:06:28 -07:00
2023-05-12 17:04:04 +09:00
2013-01-03 15:57:01 -08:00
2013-11-26 11:09:07 +01:00