Re: [PATCH] target: Fix a double put in transport_free_session
From: Maurizio Lombardi <hidden>
Date: 2021-03-26 12:32:45
Also in:
lkml, target-devel
Dne 23. 03. 21 v 3:58 Lv Yunlong napsal(a):
quoted hunk ↗ jump to hunk
In transport_free_session, se_nacl is got from se_sess with the initial reference. If se_nacl->acl_sess_list is empty, se_nacl->dynamic_stop is set to true. Then the first target_put_nacl(se_nacl) will drop the initial reference and free se_nacl. Later there is a second target_put_nacl() to put se_nacl. It may cause error in race. My patch sets se_nacl->dynamic_stop to false to avoid the double put. Signed-off-by: Lv Yunlong <redacted> --- drivers/target/target_core_transport.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c index 5ecb9f18a53d..c266defe694f 100644 --- a/drivers/target/target_core_transport.c +++ b/drivers/target/target_core_transport.c@@ -584,8 +584,10 @@ void transport_free_session(struct se_session *se_sess) } mutex_unlock(&se_tpg->acl_node_mutex); - if (se_nacl->dynamic_stop) + if (se_nacl->dynamic_stop) { target_put_nacl(se_nacl); + se_nacl->dynamic_stop = false; + } target_put_nacl(se_nacl); }
FYI, I have received a bug report against the 5.8 kernel about task hangs that seems to involve the nacl "dynamic_stop" code Mar 4 16:49:44 gzboot kernel: [186322.177819] INFO: task targetcli:2359053 blocked for more than 120 seconds. Mar 4 16:49:44 gzboot kernel: [186322.178862] Tainted: P O 5.8.0-44-generic #50-Ubuntu Mar 4 16:49:44 gzboot kernel: [186322.179746] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. Mar 4 16:49:44 gzboot kernel: [186322.180583] targetcli D 0 2359053 2359052 0x00000000 Mar 4 16:49:44 gzboot kernel: [186322.180586] Call Trace: Mar 4 16:49:44 gzboot kernel: [186322.180592] __schedule+0x212/0x5d0 Mar 4 16:49:44 gzboot kernel: [186322.180595] ? usleep_range+0x90/0x90 Mar 4 16:49:44 gzboot kernel: [186322.180596] schedule+0x55/0xc0 Mar 4 16:49:44 gzboot kernel: [186322.180597] schedule_timeout+0x10f/0x160 Mar 4 16:49:44 gzboot kernel: [186322.180601] ? evict+0x14c/0x1b0 Mar 4 16:49:44 gzboot kernel: [186322.180602] __wait_for_common+0xa8/0x150 Mar 4 16:49:44 gzboot kernel: [186322.180603] wait_for_completion+0x24/0x30 Mar 4 16:49:44 gzboot kernel: [186322.180637] core_tpg_del_initiator_node_acl+0x8e/0x120 [target_core_mod] Mar 4 16:49:44 gzboot kernel: [186322.180643] target_fabric_nacl_base_release+0x26/0x30 [target_core_mod] Mar 4 16:49:44 gzboot kernel: [186322.180647] config_item_cleanup+0x5d/0xf0 Mar 4 16:49:44 gzboot kernel: [186322.180649] config_item_put+0x2d/0x40 Mar 4 16:49:44 gzboot kernel: [186322.180651] configfs_rmdir+0x1d8/0x350 Mar 4 16:49:44 gzboot kernel: [186322.180653] vfs_rmdir.part.0+0x66/0x190 Mar 4 16:49:44 gzboot kernel: [186322.180654] do_rmdir+0x1b4/0x200 Mar 4 16:49:44 gzboot kernel: [186322.180655] __x64_sys_rmdir+0x17/0x20 Mar 4 16:49:44 gzboot kernel: [186322.180657] do_syscall_64+0x49/0xc0 Mar 4 16:49:44 gzboot kernel: [186322.180659] entry_SYSCALL_64_after_hwframe+0x44/0xa9 Mar 4 16:49:44 gzboot kernel: [186322.180660] RIP: 0033:0x7f30cf1ca9eb Mar 4 16:49:44 gzboot kernel: [186322.180661] RSP: 002b:00007ffd72030bd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 Mar 4 16:49:44 gzboot kernel: [186322.180662] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00007f30cf1ca9eb Mar 4 16:49:44 gzboot kernel: [186322.180663] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007f30cc1e2a50 Mar 4 16:49:44 gzboot kernel: [186322.180664] RBP: 0000000000a4b7a0 R08: 0000000000000000 R09: 00007ffd72030b7f Mar 4 16:49:44 gzboot kernel: [186322.180664] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd72030c00 Mar 4 16:49:44 gzboot kernel: [186322.180665] R13: 00007f30cdd706a8 R14: 00007f30ced00cc0 R15: 00007f30cdd70698 Maurizio