[PATCH] scsi: ibmvscsi: protect abort handler from done-scmd in flight

tries to access the scmd when is turned back to mempool. This patch fixes the race by ensuring when ibmvscsi_eh_abort_handler() returns, no scsi_done is in flight Signed-off-by: Liu Ping Fan --- When trying to figure the scsi_cmnd in flight issue, I learned from Paolo (thanks). He showed me the w

Re: [RFC 0/9] fix for the race issue between scsi timer and in-flight scmd

On Fri, May 30, 2014 at 4:26 PM, Paolo Bonzini wrote: > Il 30/05/2014 10:15, Liu Ping Fan ha scritto: > >> When running io stress test on large latency scsi-disk, e.g guest with >> virtscsi >> on a nfs image. It can trigger the BUG_ON(test_bit(REQ_ATOM_COMPLETE, >&g

[RFC 5/9] blk: change funcs' prototype to expose the ref of timer

req->special is normally referred by both a timer and request_queue. This patch focus on the timer's ref. It changes a group of func's prototype, so the caller can inc/dec ref, in according to add/del a timer. Signed-off-by: Liu Ping Fan --- block/blk-core

[RFC 9/9] scsi: ibmvscsi: return SUCCESS_REMOVE when finding a abort cmd

When return SUCCESS_REMOVE, it can benifit the ref on scsi_cmnd Signed-off-by: Liu Ping Fan --- drivers/scsi/ibmvscsi/ibmvscsi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c index d0fa4b6..cf78be5 100644

[RFC 3/9] scsi: introduce new internal flag SUCCESS_REMOVE

: Liu Ping Fan --- drivers/scsi/scsi_error.c | 8 +++- include/scsi/scsi.h | 1 + 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c index 3b8b95b..8ddd8f5 100644 --- a/drivers/scsi/scsi_error.c +++ b/drivers/scsi/scsi_error.c

[RFC 7/9] scsi: adopt ref on scsi_cmnd to avoid a race on request

1 cpu(s) not responding Signed-off-by: Liu Ping Fan --- drivers/scsi/scsi.c | 33 +--- drivers/scsi/scsi_error.c | 5 +++-- drivers/scsi/scsi_lib.c | 56 +-- drivers/scsi/scsi_priv.h | 3 +++ include/scsi/scsi_cmnd.h

[RFC 6/9] blk: split the reclaim of req from blk_finish_request()

Later, the low layer (scsi) can decide when to turn back the mem of req by blk_reclaim_request() Signed-off-by: Liu Ping Fan --- block/blk-core.c | 52 +- include/linux/blkdev.h | 6 -- 2 files changed, 39 insertions(+), 19 deletions

[RFC 0/9] fix for the race issue between scsi timer and in-flight scmd

mproved :) Note: all the patches are based on rhel7, whose kernel version is linux-3.10. I will rebase them onto the latest commit if my method is practical. Liu Ping Fan (9): block: make timeout_list protectd by REQ_ATOM_COMPLETE bit scsi: ensure request is dequeue when finishing scmd

[RFC 2/9] scsi: ensure request is dequeue when finishing scmd

_ON(!list_empty(&req->queuelist)) in __blk_put_request(). Signed-off-by: Liu Ping Fan --- note: I hit this bug in my test, and the above comment is my guess. Hope for more comments about it. --- block/blk.h | 1 - drivers/scsi/scsi_error.c | 1 + drivers/scsi/scsi_li

[RFC 8/9] scsi: virtscsi: work around to abort a scmd

detail in virtio) Signed-off-by: Liu Ping Fan --- drivers/scsi/virtio_scsi.c | 61 -- 1 file changed, 59 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c index b26f1a5..d08aae5 100644 --- a/drivers/scsi/vir

[RFC 4/9] blk: change the prototype of blk_complete_request()

should drop the ref immediately. Here, using the return of blk_complete_request() to notice its caller. Signed-off-by: Liu Ping Fan --- block/blk-softirq.c| 13 ++--- include/linux/blkdev.h | 2 +- 2 files changed, 11 insertions(+), 4 deletions(-) diff --git a/block/blk-softirq.c b

[RFC 1/9] block: make timeout_list protectd by REQ_ATOM_COMPLETE bit

The "request->timeout_list" is under the risk of modified by both timeout (abort handler) and a "finishing" handler. Using bit REQ_ATOM_COMPLETE in atomic_flags as a guard to shield this issue. Signed-off-by: Liu Ping Fan --- block/blk-timeout.c | 5 +++-- 1 file chan

[RFC 4/9] blk: change the prototype of blk_complete_request()

should drop the ref immediately. Here, using the return of blk_complete_request() to notice its caller. Signed-off-by: Liu Ping Fan --- block/blk-softirq.c| 13 ++--- include/linux/blkdev.h | 2 +- 2 files changed, 11 insertions(+), 4 deletions(-) diff --git a/block/blk-softirq.c b