From patchwork Fri Jul 31 09:52:10 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jiang Biao X-Patchwork-Id: 6909831 Return-Path: X-Original-To: patchwork-linux-scsi@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 26ED19F380 for ; Fri, 31 Jul 2015 10:08:54 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 3C16620613 for ; Fri, 31 Jul 2015 10:08:53 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id C645E20611 for ; Fri, 31 Jul 2015 10:08:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752025AbbGaKIv (ORCPT ); Fri, 31 Jul 2015 06:08:51 -0400 Received: from mx7.zte.com.cn ([202.103.147.169]:47117 "EHLO zte.com.cn" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751029AbbGaKIu (ORCPT ); Fri, 31 Jul 2015 06:08:50 -0400 X-Greylist: delayed 958 seconds by postgrey-1.27 at vger.kernel.org; Fri, 31 Jul 2015 06:08:50 EDT Received: from mse01.zte.com.cn (unknown [10.30.3.20]) by Websense Email Security Gateway with ESMTPS id 034DECDBEB896; Fri, 31 Jul 2015 17:52:46 +0800 (CST) Received: from notes_smtp.zte.com.cn ([10.30.1.239]) by mse01.zte.com.cn with ESMTP id t6V9qQP3006495; Fri, 31 Jul 2015 17:52:26 +0800 (GMT-8) (envelope-from jiang.biao2@zte.com.cn) To: linux-scsi@vger.kernel.org, JBottomley@odin.com Subject: [Patch] scsi_error: should not get sense for timeout IO in scsi error handler MIME-Version: 1.0 X-KeepSent: AF74C95C:6058723F-48257E93:00322982; type=4; name=$KeepSent X-Mailer: Lotus Notes Release 8.5.3 September 15, 2011 Message-ID: From: jiang.biao2@zte.com.cn Date: Fri, 31 Jul 2015 17:52:10 +0800 X-MIMETrack: Serialize by Router on notes_smtp/zte_ltd(Release 8.5.3FP6|November 21, 2013) at 2015-07-31 17:52:25, Serialize complete at 2015-07-31 17:52:25 X-MAIL: mse01.zte.com.cn t6V9qQP3006495 Sender: linux-scsi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-scsi@vger.kernel.org X-Spam-Status: No, score=-6.6 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY, URIBL_BLACK autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP scsi_error: should not get sense for timeout IO in scsi error handler When an IO timeout occurs, the IO will be aborted in scsi_abort_command() and SCSI_EH_ABORT_SCHEDULED will be set. Because of that, the SCSI_EH_CANCEL_CMD will be clear in scsi_eh_scmd_add(). So when scsi error handler starts, it will get sense for this timeout IO and the scmd of the IO request will be reused. In that case, the scmd may be double released when racing with io_done(), which will result in crash. SO SCSI_EH_ABORT_SCHEDULED should also be checked when getting sense. The bug maybe reproduced when the link between host and disk is unstable. Signed-off-by: Jiang Biao Signed-off-by: Long Chun Reviewed-by: Tan Hu Reviewed-by: Chen Donghai Reviewed-by: Cai Qu Reviewed-by: Hannes Reinecke --- To unsubscribe from this list: send the line "unsubscribe linux-scsi" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff -uprN drivers/scsi/scsi_error.c drivers_new/scsi/scsi_error.c --- scsi/scsi_error.c 2015-07-31 16:03:18.000000000 +0800 +++ scsi_new/scsi_error.c 2015-07-31 16:29:25.000000000 +0800 @@ -1156,9 +1156,14 @@ int scsi_eh_get_sense(struct list_head * struct Scsi_Host *shost; int rtn; + /* + * If SCSI_EH_ABORT_SCHEDULED has been set, it is timeout IO, + * should not get sense. + */ list_for_each_entry_safe(scmd, next, work_q, eh_entry) { if ((scmd->eh_eflags & SCSI_EH_CANCEL_CMD) || - SCSI_SENSE_VALID(scmd)) + (scmd->eh_eflags & SCSI_EH_ABORT_SCHEDULED) || + SCSI_SENSE_VALID(scmd)) continue; shost = scmd->device->host;