From patchwork Wed Feb 15 00:25:44 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bart Van Assche X-Patchwork-Id: 9573129 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 57F6D600F6 for ; Wed, 15 Feb 2017 00:27:32 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 4B6192841A for ; Wed, 15 Feb 2017 00:27:32 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 3FE312843B; Wed, 15 Feb 2017 00:27:32 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 5D7BE2841A for ; Wed, 15 Feb 2017 00:27:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751461AbdBOA12 (ORCPT ); Tue, 14 Feb 2017 19:27:28 -0500 Received: from esa2.hgst.iphmx.com ([68.232.143.124]:36970 "EHLO esa2.hgst.iphmx.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750905AbdBOA10 (ORCPT ); Tue, 14 Feb 2017 19:27:26 -0500 X-IronPort-AV: E=Sophos;i="5.35,163,1483977600"; d="scan'208";a="81774849" Received: from unknown (HELO milsmgep15.sandisk.com) ([63.163.107.21]) by ob1.hgst.iphmx.com with ESMTP; 15 Feb 2017 08:43:11 +0800 Received: from MILHUBIP03.sdcorp.global.sandisk.com (Unknown_Domain [10.201.67.162]) (using TLS with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by (Symantec Messaging Gateway) with SMTP id 87.E4.57638.A20A3A85; Tue, 14 Feb 2017 16:26:19 -0800 (PST) Received: from milsmgip11.sandisk.com (10.177.9.6) by MILHUBIP03.sdcorp.global.sandisk.com (10.177.9.96) with Microsoft SMTP Server id 14.3.319.2; Tue, 14 Feb 2017 16:26:15 -0800 X-AuditID: 0ac94369-26dee9800001e126-6b-58a3a02a4753 Received: from exp-402881.sdcorp.global.sandisk.com ( [10.177.9.6]) by (Symantec Messaging Gateway) with SMTP id A8.7D.11415.720A3A85; Tue, 14 Feb 2017 16:26:15 -0800 (PST) From: Bart Van Assche To: "Nicholas A . Bellinger" CC: , Bart Van Assche , Himanshu Madhani , Quinn Tran Subject: [PATCH v6 05/33] tcm_qla2xxx: Fix reference leaks related to aborting commands Date: Tue, 14 Feb 2017 16:25:44 -0800 Message-ID: <20170215002612.14566-6-bart.vanassche@sandisk.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20170215002612.14566-1-bart.vanassche@sandisk.com> References: <20170215002612.14566-1-bart.vanassche@sandisk.com> X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFrrILMWRmVeSWpSXmKPExsXCddJ5ka72gsURBi+iLC7s6Wa0aFt9htHi Z/trRovWpW+ZHFg8ZvxexOJxf/sRJo/Pm+QCmKO4bFJSczLLUov07RK4MhbOusFa8M+7Yvrf DSwNjLfsuhg5OSQETCTmn9rK3sXIxSEksJRJonH/FhYIZxujxOoVV9lhqmY8e88GkdjIKLH9 0CQWkASbgJHEt/czwWwRIHt1zzImkCJmgRWMEo9apjCCJIQFwiUat21hArFZBFQlOu9ATOUV sJd4f+oBG8QGeYldbRdZQWxOAQeJGTtOAg3lANpmL/HojDXITAmBJlaJfe3nWSF6BSVOznwC tphZQELi4IsXzCC2kIC6xMkl85kmMArNQlI2C0nZAkamVYxiuZk5xbnpqQWGpnrFiXkpmcXZ esn5uZsYIQGduYPx7hPvQ4wCHIxKPLwnZBdHCLEmlhVX5h5ilOBgVhLhZasHCvGmJFZWpRbl xxeV5qQWH2KU5mBREuc9JzM1QkggPbEkNTs1tSC1CCbLxMEp1cCYppgw8R5LstGOI2wSr5fI N6gunKH5u/+JkFrF5ORX95K/bA04OOma4s05D/llV2QeCV27KcrisYe4lutMbpHDh7om+fKL HnwnIfvN/vr83S+9dfetP5lZdWL6HufJCaY+8lqOi5iUE3ftMZCfFCLw4Ynr0n+RDwRaLL76 NSeefj5vfsfCSXdTlFiKMxINtZiLihMBIRadD2QCAAA= X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFlrAJMWRmVeSWpSXmKPExsXCtZGTTVd9weIIgw2HeSwO/mxjtLiwp5vR om31GUaLn+2vGS1al75lcmD1mPF7EYvH/e1HmDymrTnP5PF5k1wASxSXTUpqTmZZapG+XQJX xsJZN1gL/nlXTP+7gaWB8ZZdFyMnh4SAicSMZ+/Zuhi5OIQE1jNKNKzayQiSYBMwkvj2fiYL iC0CZK/uWcYEUsQssIJRYt2SN2wgCWGBcInGbVuYQGwWAVWJzjtX2bsYOTh4BewlGpZJQiyQ l9jVdpEVxOYUcJCYseMkC0iJEFDJozPWExi5FzAyrGIUy83MKc5NzywwNNQrTsxLySzO1kvO z93ECAmDyB2MTyeaH2Jk4uCUamAsVmmJyDvd1vx81Vv+1kXC8gdVy9m2ZP1aeCJh7/stN9gn MX4K2qT8uHXR9DOFO+o87cT/9N3XmvzO9/kSqU5hzR1Voc8u1914pZJdFHy++HO6rAjn2fkv f179Y3DfvV95P8/6vOPZNyQMOeqq1BvPnvjYWLr4S+6OLk7tvR8ZHRdZvfgRcGGXEktxRqKh FnNRcSIAqQNcDrMBAAA= MIME-Version: 1.0 Sender: target-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: target-devel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Since it is almost impossible to verify that the current qla2xxx target code calls transport_generic_free_cmd() after processing of a command has finished, rework the target code as follows: - Remove the code for freeing a command from qlt_send_term_exchange() and make the callers of this function responsible for freeing a command. - Remove qlt_abort_cmd_on_host_reset(). Since that function freed the command it aborted, move the responsibility for freeing a command to the callers of that code. - In all TCM callback functions, ensure that either an error code is returned, the hardware will trigger an interrupt later on or that 0 is returned and transport_generic_free_cmd() is called. Signed-off-by: Bart Van Assche Cc: Himanshu Madhani Cc: Quinn Tran --- drivers/scsi/qla2xxx/qla_target.c | 66 +++++--------------------------------- drivers/scsi/qla2xxx/tcm_qla2xxx.c | 33 +++++++++++++++---- 2 files changed, 35 insertions(+), 64 deletions(-) diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c index 5a3fd2c63512..3ffa99a4daff 100644 --- a/drivers/scsi/qla2xxx/qla_target.c +++ b/drivers/scsi/qla2xxx/qla_target.c @@ -115,8 +115,6 @@ static int qlt_issue_task_mgmt(struct fc_port *sess, u64 lun, int fn, void *iocb, int flags); static void qlt_send_term_exchange(struct scsi_qla_host *ha, struct qla_tgt_cmd *cmd, struct atio_from_isp *atio, int ha_locked, int ul_abort); -static void qlt_abort_cmd_on_host_reset(struct scsi_qla_host *vha, - struct qla_tgt_cmd *cmd); static void qlt_alloc_qfull_cmd(struct scsi_qla_host *vha, struct atio_from_isp *atio, uint16_t status, int qfull); static void qlt_disable_vha(struct scsi_qla_host *vha); @@ -2860,13 +2858,10 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type, spin_lock_irqsave(&ha->hardware_lock, flags); if (cmd->sess && cmd->sess->deleted) { cmd->state = QLA_TGT_STATE_PROCESSED; - if (cmd->sess->logout_completed) - /* no need to terminate. FW already freed exchange. */ - qlt_abort_cmd_on_host_reset(cmd->vha, cmd); - else + if (!cmd->sess->logout_completed) qlt_send_term_exchange(vha, cmd, &cmd->atio, 1, 0); spin_unlock_irqrestore(&ha->hardware_lock, flags); - return 0; + return -ENOENT; } spin_unlock_irqrestore(&ha->hardware_lock, flags); @@ -2897,13 +2892,12 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type, * previous life, just abort the processing. */ cmd->state = QLA_TGT_STATE_PROCESSED; - qlt_abort_cmd_on_host_reset(cmd->vha, cmd); ql_dbg(ql_dbg_async, vha, 0xe101, "RESET-RSP online/active/old-count/new-count = %d/%d/%d/%d.\n", vha->flags.online, qla2x00_reset_active(vha), cmd->reset_count, ha->chip_reset); spin_unlock_irqrestore(&ha->hardware_lock, flags); - return 0; + return -ENOENT; } /* Does F/W have an IOCBs for this request */ @@ -3039,13 +3033,12 @@ int qlt_rdy_to_xfer(struct qla_tgt_cmd *cmd) * previous life, just abort the processing. */ cmd->state = QLA_TGT_STATE_NEED_DATA; - qlt_abort_cmd_on_host_reset(cmd->vha, cmd); ql_dbg(ql_dbg_async, vha, 0xe102, "RESET-XFR online/active/old-count/new-count = %d/%d/%d/%d.\n", vha->flags.online, qla2x00_reset_active(vha), cmd->reset_count, ha->chip_reset); spin_unlock_irqrestore(&ha->hardware_lock, flags); - return 0; + return -EINTR; } /* Does F/W have an IOCBs for this request */ @@ -3395,12 +3388,6 @@ static void qlt_send_term_exchange(struct scsi_qla_host *vha, qlt_alloc_qfull_cmd(vha, atio, 0, 0); done: - if (cmd && !ul_abort && !cmd->aborted) { - if (cmd->sg_mapped) - qlt_unmap_sg(vha, cmd); - vha->hw->tgt.tgt_ops->free_cmd(cmd); - } - if (!ha_locked) spin_unlock_irqrestore(&vha->hw->hardware_lock, flags); @@ -3596,42 +3583,6 @@ static struct qla_tgt_cmd *qlt_ctio_to_cmd(struct scsi_qla_host *vha, return cmd; } -/* hardware_lock should be held by caller. */ -static void -qlt_abort_cmd_on_host_reset(struct scsi_qla_host *vha, struct qla_tgt_cmd *cmd) -{ - struct qla_hw_data *ha = vha->hw; - uint32_t handle; - - if (cmd->sg_mapped) - qlt_unmap_sg(vha, cmd); - - handle = qlt_make_handle(vha); - - /* TODO: fix debug message type and ids. */ - if (cmd->state == QLA_TGT_STATE_PROCESSED) { - ql_dbg(ql_dbg_io, vha, 0xff00, - "HOST-ABORT: handle=%d, state=PROCESSED.\n", handle); - } else if (cmd->state == QLA_TGT_STATE_NEED_DATA) { - cmd->write_data_transferred = 0; - cmd->state = QLA_TGT_STATE_DATA_IN; - - ql_dbg(ql_dbg_io, vha, 0xff01, - "HOST-ABORT: handle=%d, state=DATA_IN.\n", handle); - - ha->tgt.tgt_ops->handle_data(cmd); - return; - } else { - ql_dbg(ql_dbg_io, vha, 0xff03, - "HOST-ABORT: handle=%d, state=BAD(%d).\n", handle, - cmd->state); - dump_stack(); - } - - cmd->trc_flags |= TRC_FLUSH; - ha->tgt.tgt_ops->free_cmd(cmd); -} - void qlt_host_reset_handler(struct qla_hw_data *ha) { @@ -3661,8 +3612,7 @@ qlt_host_reset_handler(struct qla_hw_data *ha) if (!cmd) continue; /* ha->tgt.cmds entry is cleared by qlt_get_cmd. */ - vha = cmd->vha; - qlt_abort_cmd_on_host_reset(vha, cmd); + /* To do: abort cmd. */ } spin_unlock_irqrestore(&ha->hardware_lock, flags); } @@ -3790,7 +3740,7 @@ static void qlt_do_ctio_completion(struct scsi_qla_host *vha, uint32_t handle, (!cmd->aborted)) { cmd->trc_flags |= TRC_CTIO_ERR; if (qlt_term_ctio_exchange(vha, ctio, cmd, status)) - return; + goto free_cmd; } } skip_term: @@ -3822,6 +3772,7 @@ static void qlt_do_ctio_completion(struct scsi_qla_host *vha, uint32_t handle, dump_stack(); } +free_cmd: ha->tgt.tgt_ops->free_cmd(cmd); } @@ -3931,8 +3882,7 @@ static void __qlt_do_work(struct qla_tgt_cmd *cmd) spin_lock_irqsave(&ha->hardware_lock, flags); qlt_send_term_exchange(vha, NULL, &cmd->atio, 1, 0); - qlt_decr_num_pend_cmds(vha); - percpu_ida_free(&sess->se_sess->sess_tag_pool, cmd->se_cmd.map_tag); + qlt_free_cmd(cmd); spin_unlock_irqrestore(&ha->hardware_lock, flags); spin_lock_irqsave(&ha->tgt.sess_lock, flags); diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c index 061ba85a2168..a8d1da62e6bd 100644 --- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c +++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c @@ -361,6 +361,7 @@ static int tcm_qla2xxx_write_pending(struct se_cmd *se_cmd) { struct qla_tgt_cmd *cmd = container_of(se_cmd, struct qla_tgt_cmd, se_cmd); + int res; if (cmd->aborted) { /* Cmd can loop during Q-full. tcm_qla2xxx_aborted_task @@ -373,7 +374,7 @@ static int tcm_qla2xxx_write_pending(struct se_cmd *se_cmd) cmd->se_cmd.transport_state, cmd->se_cmd.t_state, cmd->se_cmd.se_cmd_flags); - return 0; + goto aborted; } cmd->trc_flags |= TRC_XFR_RDY; cmd->bufflen = se_cmd->data_length; @@ -391,7 +392,14 @@ static int tcm_qla2xxx_write_pending(struct se_cmd *se_cmd) * qla_target.c:qlt_rdy_to_xfer() will call pci_map_sg() to setup * the SGL mappings into PCIe memory for incoming FCP WRITE data. */ - return qlt_rdy_to_xfer(cmd); + res = qlt_rdy_to_xfer(cmd); + if (res != -EINTR) + return res; + +aborted: + target_put_sess_cmd(se_cmd); + transport_generic_free_cmd(se_cmd, 0); + return 0; } static int tcm_qla2xxx_write_pending_status(struct se_cmd *se_cmd) @@ -488,7 +496,8 @@ static void tcm_qla2xxx_handle_data_work(struct work_struct *work) if (cmd->aborted) { spin_unlock_irqrestore(&cmd->cmd_lock, flags); - tcm_qla2xxx_free_cmd(cmd); + target_put_sess_cmd(&cmd->se_cmd); + transport_generic_free_cmd(&cmd->se_cmd, 0); return; } spin_unlock_irqrestore(&cmd->cmd_lock, flags); @@ -593,6 +602,7 @@ static int tcm_qla2xxx_queue_data_in(struct se_cmd *se_cmd) { struct qla_tgt_cmd *cmd = container_of(se_cmd, struct qla_tgt_cmd, se_cmd); + int res; if (cmd->aborted) { /* Cmd can loop during Q-full. tcm_qla2xxx_aborted_task @@ -605,6 +615,7 @@ static int tcm_qla2xxx_queue_data_in(struct se_cmd *se_cmd) cmd->se_cmd.transport_state, cmd->se_cmd.t_state, cmd->se_cmd.se_cmd_flags); + transport_generic_free_cmd(se_cmd, 0); return 0; } @@ -624,15 +635,20 @@ static int tcm_qla2xxx_queue_data_in(struct se_cmd *se_cmd) /* * Now queue completed DATA_IN the qla2xxx LLD and response ring */ - return qlt_xmit_response(cmd, QLA_TGT_XMIT_DATA|QLA_TGT_XMIT_STATUS, + res = qlt_xmit_response(cmd, QLA_TGT_XMIT_DATA | QLA_TGT_XMIT_STATUS, se_cmd->scsi_status); + if (res != 0 && res != -ENOMEM && res != -EAGAIN) { + transport_generic_free_cmd(se_cmd, 0); + res = 0; + } + return res; } static int tcm_qla2xxx_queue_status(struct se_cmd *se_cmd) { struct qla_tgt_cmd *cmd = container_of(se_cmd, struct qla_tgt_cmd, se_cmd); - int xmit_type = QLA_TGT_XMIT_STATUS; + int xmit_type = QLA_TGT_XMIT_STATUS, res; cmd->bufflen = se_cmd->data_length; cmd->sg = NULL; @@ -662,7 +678,12 @@ static int tcm_qla2xxx_queue_status(struct se_cmd *se_cmd) /* * Now queue status response to qla2xxx LLD code and response ring */ - return qlt_xmit_response(cmd, xmit_type, se_cmd->scsi_status); + res = qlt_xmit_response(cmd, xmit_type, se_cmd->scsi_status); + if (res != 0 && res != -ENOMEM && res != -EAGAIN) { + transport_generic_free_cmd(se_cmd, 0); + res = 0; + } + return res; } static void tcm_qla2xxx_queue_tm_rsp(struct se_cmd *se_cmd)