queue <-> sdev reference counting problem

Hi,

There is a problem with the way sdev is freed currently. The reason is really that there is a circular referencing problem: the sdev needs to hold on to the queue, but the queue (through the request function) also needs to hold on to the sdev.

The easiest way to work-around this problem is to kill the sdev reference in the queue when the sdev is freed. On invocation of scsi_request_fn(), kill io to this device.

Signed-off-by Jens Axboe <[email protected]>

===== drivers/scsi/scsi_lib.c 1.151 vs edited =====

drivers/scsi/scsi_lib.c +24 -1

@@ -1233,6 +1233,22 @@ static inline int scsi_host_queue_ready(
 }
 
 /*
+ * Kill requests for a dead device
+ */
+static void scsi_kill_requests(request_queue_t *q)
+{
+	struct request *req;
+
+	while ((req = elv_next_request(q)) != NULL) {
+		blkdev_dequeue_request(req);
+		req->flags |= REQ_QUIET;
+		while (end_that_request_first(req, 0, req->nr_sectors))
+			;
+		end_that_request_last(req);
+	}
+}
+
+/*
  * Function:    scsi_request_fn()
  *
  * Purpose:     Main strategy routine for SCSI.

@@ -1246,10 +1262,16 @@ static inline int scsi_host_queue_ready(
 static void scsi_request_fn(struct request_queue *q)
 {
 	struct scsi_device *sdev = q->queuedata;
-	struct Scsi_Host *shost = sdev->host;
+	struct Scsi_Host *shost;
 	struct scsi_cmnd *cmd;
 	struct request *req;
 
+	if (!sdev) {
+		printk("scsi: killing requests for dead queue\n");
+		scsi_kill_requests(q);
+		return;
+	}
+
 	if(!get_device(&sdev->sdev_gendev))
 		/* We must be tearing the block queue down already */
 		return;

@@ -1258,6 +1280,7 @@ static void scsi_request_fn(struct reque
 	 * To start with, we keep looping until the queue is empty, or until
 	 * the host is no longer able to accept any more requests.
 	 */
+	shost = sdev->host;
 	while (!blk_queue_plugged(q)) {
 		int rtn;
 		/*

===== drivers/scsi/scsi_sysfs.c 1.69 vs edited =====

drivers/scsi/scsi_sysfs.c +0 -0

@@ -168,8 +168,10 @@ void scsi_device_dev_release(struct devi
 	list_del(&sdev->starved_entry);

This is not even enough, since the queue lock is embedded in sdev structure. Guys, this is a serious issue. Oopsing a kernel is trivial with a hotplug device like a usb stick.

Quoted 3 lines · Jens Axboe

This is not even enough, since the queue lock is embedded in sdev structure. Guys, this is a serious issue. Oopsing a kernel is trivial with a hotplug device like a usb stick.

Do you have the instructions to reproduce and a trace ... I've got a USB pendrive I can try with.