Re: [PATCH] target: Fix a double put in transport_free_session
From: Maurizio Lombardi
Date: Fri Mar 26 2021 - 08:32:45 EST
Dne 23. 03. 21 v 3:58 Lv Yunlong napsal(a):
> In transport_free_session, se_nacl is got from se_sess
> with the initial reference. If se_nacl->acl_sess_list is
> empty, se_nacl->dynamic_stop is set to true. Then the first
> target_put_nacl(se_nacl) will drop the initial reference
> and free se_nacl. Later there is a second target_put_nacl()
> to put se_nacl. It may cause error in race.
>
> My patch sets se_nacl->dynamic_stop to false to avoid the
> double put.
>
> Signed-off-by: Lv Yunlong <lyl2019@xxxxxxxxxxxxxxxx>
> ---
> drivers/target/target_core_transport.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
> index 5ecb9f18a53d..c266defe694f 100644
> --- a/drivers/target/target_core_transport.c
> +++ b/drivers/target/target_core_transport.c
> @@ -584,8 +584,10 @@ void transport_free_session(struct se_session *se_sess)
> }
> mutex_unlock(&se_tpg->acl_node_mutex);
>
> - if (se_nacl->dynamic_stop)
> + if (se_nacl->dynamic_stop) {
> target_put_nacl(se_nacl);
> + se_nacl->dynamic_stop = false;
> + }
>
> target_put_nacl(se_nacl);
> }
>
FYI,
I have received a bug report against the 5.8 kernel about task hangs that seems to involve the nacl "dynamic_stop" code
Mar 4 16:49:44 gzboot kernel: [186322.177819] INFO: task targetcli:2359053 blocked for more than 120 seconds.
Mar 4 16:49:44 gzboot kernel: [186322.178862] Tainted: P O 5.8.0-44-generic #50-Ubuntu
Mar 4 16:49:44 gzboot kernel: [186322.179746] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
Mar 4 16:49:44 gzboot kernel: [186322.180583] targetcli D 0 2359053 2359052 0x00000000
Mar 4 16:49:44 gzboot kernel: [186322.180586] Call Trace:
Mar 4 16:49:44 gzboot kernel: [186322.180592] __schedule+0x212/0x5d0
Mar 4 16:49:44 gzboot kernel: [186322.180595] ? usleep_range+0x90/0x90
Mar 4 16:49:44 gzboot kernel: [186322.180596] schedule+0x55/0xc0
Mar 4 16:49:44 gzboot kernel: [186322.180597] schedule_timeout+0x10f/0x160
Mar 4 16:49:44 gzboot kernel: [186322.180601] ? evict+0x14c/0x1b0
Mar 4 16:49:44 gzboot kernel: [186322.180602] __wait_for_common+0xa8/0x150
Mar 4 16:49:44 gzboot kernel: [186322.180603] wait_for_completion+0x24/0x30
Mar 4 16:49:44 gzboot kernel: [186322.180637] core_tpg_del_initiator_node_acl+0x8e/0x120 [target_core_mod]
Mar 4 16:49:44 gzboot kernel: [186322.180643] target_fabric_nacl_base_release+0x26/0x30 [target_core_mod]
Mar 4 16:49:44 gzboot kernel: [186322.180647] config_item_cleanup+0x5d/0xf0
Mar 4 16:49:44 gzboot kernel: [186322.180649] config_item_put+0x2d/0x40
Mar 4 16:49:44 gzboot kernel: [186322.180651] configfs_rmdir+0x1d8/0x350
Mar 4 16:49:44 gzboot kernel: [186322.180653] vfs_rmdir.part.0+0x66/0x190
Mar 4 16:49:44 gzboot kernel: [186322.180654] do_rmdir+0x1b4/0x200
Mar 4 16:49:44 gzboot kernel: [186322.180655] __x64_sys_rmdir+0x17/0x20
Mar 4 16:49:44 gzboot kernel: [186322.180657] do_syscall_64+0x49/0xc0
Mar 4 16:49:44 gzboot kernel: [186322.180659] entry_SYSCALL_64_after_hwframe+0x44/0xa9
Mar 4 16:49:44 gzboot kernel: [186322.180660] RIP: 0033:0x7f30cf1ca9eb
Mar 4 16:49:44 gzboot kernel: [186322.180661] RSP: 002b:00007ffd72030bd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
Mar 4 16:49:44 gzboot kernel: [186322.180662] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00007f30cf1ca9eb
Mar 4 16:49:44 gzboot kernel: [186322.180663] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007f30cc1e2a50
Mar 4 16:49:44 gzboot kernel: [186322.180664] RBP: 0000000000a4b7a0 R08: 0000000000000000 R09: 00007ffd72030b7f
Mar 4 16:49:44 gzboot kernel: [186322.180664] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd72030c00
Mar 4 16:49:44 gzboot kernel: [186322.180665] R13: 00007f30cdd706a8 R14: 00007f30ced00cc0 R15: 00007f30cdd70698
Maurizio