• Maurizio Lombardi's avatar
    scsi: target: fix hang when multiple threads try to destroy the same iscsi session · 57c46e9f
    Maurizio Lombardi authored
    A number of hangs have been reported against the target driver; they are
    due to the fact that multiple threads may try to destroy the iscsi session
    at the same time. This may be reproduced for example when a "targetcli
    iscsi/iqn.../tpg1 disable" command is executed while a logout operation is
    underway.
    
    When this happens, two or more threads may end up sleeping and waiting for
    iscsit_close_connection() to execute "complete(session_wait_comp)".  Only
    one of the threads will wake up and proceed to destroy the session
    structure, the remaining threads will hang forever.
    
    Note that if the blocked threads are somehow forced to wake up with
    complete_all(), they will try to free the same iscsi session structure
    destroyed by the first thread, causing double frees, memory corruptions
    etc...
    
    With this patch, the threads that want to destroy the iscsi session will
    increase the session refcount and will set the "session_close" flag to 1;
    then they wait for the driver to close the remaining active connections.
    When the last connection is closed, iscsit_close_connection() will wake up
    all the threads and will wait for the session's refcount to reach zero;
    when this happens, iscsit_close_connection() will destroy the session
    structure because no one is referencing it anymore.
    
     INFO: task targetcli:5971 blocked for more than 120 seconds.
           Tainted: P           OE    4.15.0-72-generic #81~16.04.1
     "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
     targetcli       D    0  5971      1 0x00000080
     Call Trace:
      __schedule+0x3d6/0x8b0
      ? vprintk_func+0x44/0xe0
      schedule+0x36/0x80
      schedule_timeout+0x1db/0x370
      ? __dynamic_pr_debug+0x8a/0xb0
      wait_for_completion+0xb4/0x140
      ? wake_up_q+0x70/0x70
      iscsit_free_session+0x13d/0x1a0 [iscsi_target_mod]
      iscsit_release_sessions_for_tpg+0x16b/0x1e0 [iscsi_target_mod]
      iscsit_tpg_disable_portal_group+0xca/0x1c0 [iscsi_target_mod]
      lio_target_tpg_enable_store+0x66/0xe0 [iscsi_target_mod]
      configfs_write_file+0xb9/0x120
      __vfs_write+0x1b/0x40
      vfs_write+0xb8/0x1b0
      SyS_write+0x5c/0xe0
      do_syscall_64+0x73/0x130
      entry_SYSCALL_64_after_hwframe+0x3d/0xa2
    
    Link: https://lore.kernel.org/r/20200313170656.9716-3-mlombard@redhat.comReported-by: default avatarMatt Coleman <mcoleman@datto.com>
    Tested-by: default avatarMatt Coleman <mcoleman@datto.com>
    Tested-by: default avatarRahul Kundu <rahul.kundu@chelsio.com>
    Signed-off-by: default avatarMaurizio Lombardi <mlombard@redhat.com>
    Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
    57c46e9f
iscsi_target_login.c 39.3 KB