lkml.org 
[lkml]   [2018]   [May]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectBUG: scsi/qla2xxx: BUG_ON(blk_queued_rq(req) is triggered in blk_finish_request
Date


Hi all

Our customer met a panic triggered by BUG_ON in blk_finish_request.
From the dmesg log, the BUG_ON was triggered after command abort occurred many times.
There is a race condition in the following scenario.

cpu A cpu B
kworker interrupt

scmd_eh_abort_handler()
-> scsi_try_to_abort_cmd()
-> qla2xxx_eh_abort()
-> qla2x00_eh_wait_on_command() qla2x00_status_entry()
-> qla2x00_sp_compl()
-> qla2x00_sp_free_dma()
-> scsi_queue_insert()
-> __scsi_queue_insert()
-> blk_requeue_request()
-> blk_clear_rq_complete()
-> scsi_done
-> blk_complete_request
-> blk_mark_rq_complete
-> elv_requeue_request() -> __blk_complete_request()
-> __elv_add_request()
// req will be queued here
BLK_SOFTIRQ
scsi_softirq_done()
-> scsi_finish_command()
-> scsi_io_completion()
-> scsi_end_request()
-> blk_finish_request() // BUG_ON(blk_queued_rq(req)) !!!

The issue will not be triggered most of time, because the request is marked as complete by timeout path.
So the scsi_done from qla2x00_sp_compl does nothing.
But as the scenario above, if the complete state has been cleaned by blk_requeue_request, we will get
the request both requeued and completed, and then BUG_ON(blk_queued_rq(req)) in blk_finish_request comes up.

Is there any solution for this in qla2xxx driver side ?

Thanks
Jianchao

\
 
 \ /
  Last update: 2018-05-23 05:56    [W:0.067 / U:2.056 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site