Commit 8a1116c4 authored by Ming Lei's avatar Ming Lei Committed by Li Nan
Browse files

scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler 

mainline inclusion
from mainline-v6.8-rc3
commit 4373534a9850627a2695317944898eb1283a2db0
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I96GXK
CVE: CVE-2024-26627

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4373534a9850627a2695317944898eb1283a2db0



--------------------------------

Inside scsi_eh_wakeup(), scsi_host_busy() is called & checked with host
lock every time for deciding if error handler kthread needs to be waken up.

This can be too heavy in case of recovery, such as:

 - N hardware queues

 - queue depth is M for each hardware queue

 - each scsi_host_busy() iterates over (N * M) tag/requests

If recovery is triggered in case that all requests are in-flight, each
scsi_eh_wakeup() is strictly serialized, when scsi_eh_wakeup() is called
for the last in-flight request, scsi_host_busy() has been run for (N * M -
1) times, and request has been iterated for (N*M - 1) * (N * M) times.

If both N and M are big enough, hard lockup can be triggered on acquiring
host lock, and it is observed on mpi3mr(128 hw queues, queue depth 8169).

Fix the issue by calling scsi_host_busy() outside the host lock. We don't
need the host lock for getting busy count because host the lock never
covers that.

[mkp: Drop unnecessary 'busy' variables pointed out by Bart]

Cc: Ewan Milne <emilne@redhat.com>
Fixes: 6eb045e0 ("scsi: core: avoid host-wide host_busy counter for scsi_mq")
Signed-off-by: default avatarMing Lei <ming.lei@redhat.com>
Link: https://lore.kernel.org/r/20240112070000.4161982-1-ming.lei@redhat.com


Reviewed-by: default avatarEwan D. Milne <emilne@redhat.com>
Reviewed-by: default avatarSathya Prakash Veerichetty <safhya.prakash@broadcom.com>
Tested-by: default avatarSathya Prakash Veerichetty <safhya.prakash@broadcom.com>
Reviewed-by: default avatarBart Van Assche <bvanassche@acm.org>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: default avatarLi Nan <linan122@huawei.com>
parent 2173cb4a

drivers/scsi/scsi_error.c

+4 −4
Original line number Diff line number Diff line
@@ -61,11 +61,11 @@ static int scsi_eh_try_stu(struct scsi_cmnd *scmd); 
static enum scsi_disposition scsi_try_to_abort_cmd(const struct scsi_host_template *,

						   struct scsi_cmnd *);



void scsi_eh_wakeup(struct Scsi_Host *shost)

void scsi_eh_wakeup(struct Scsi_Host *shost, unsigned int busy)

{

	lockdep_assert_held(shost->host_lock);



	if (scsi_host_busy(shost) == shost->host_failed) {

	if (busy == shost->host_failed) {

		trace_scsi_eh_wakeup(shost);

		wake_up_process(shost->ehandler);

		SCSI_LOG_ERROR_RECOVERY(5, shost_printk(KERN_INFO, shost,
@@ -88,7 +88,7 @@ void scsi_schedule_eh(struct Scsi_Host *shost) 
	if (scsi_host_set_state(shost, SHOST_RECOVERY) == 0 ||

	    scsi_host_set_state(shost, SHOST_CANCEL_RECOVERY) == 0) {

		shost->host_eh_scheduled++;

		scsi_eh_wakeup(shost);

		scsi_eh_wakeup(shost, scsi_host_busy(shost));

	}



	spin_unlock_irqrestore(shost->host_lock, flags);
@@ -286,7 +286,7 @@ static void scsi_eh_inc_host_failed(struct rcu_head *head) 


	spin_lock_irqsave(shost->host_lock, flags);

	shost->host_failed++;

	scsi_eh_wakeup(shost);

	scsi_eh_wakeup(shost, scsi_host_busy(shost));

	spin_unlock_irqrestore(shost->host_lock, flags);

}

drivers/scsi/scsi_lib.c

+1 −1
Original line number Diff line number Diff line
@@ -280,7 +280,7 @@ static void scsi_dec_host_busy(struct Scsi_Host *shost, struct scsi_cmnd *cmd) 
	if (unlikely(scsi_host_in_recovery(shost))) {

		spin_lock_irqsave(shost->host_lock, flags);

		if (shost->host_failed || shost->host_eh_scheduled)

			scsi_eh_wakeup(shost);

			scsi_eh_wakeup(shost, scsi_host_busy(shost));

		spin_unlock_irqrestore(shost->host_lock, flags);

	}

	rcu_read_unlock();

drivers/scsi/scsi_priv.h

+1 −1
Original line number Diff line number Diff line
@@ -92,7 +92,7 @@ extern void scmd_eh_abort_handler(struct work_struct *work); 
extern enum blk_eh_timer_return scsi_timeout(struct request *req);

extern int scsi_error_handler(void *host);

extern enum scsi_disposition scsi_decide_disposition(struct scsi_cmnd *cmd);

extern void scsi_eh_wakeup(struct Scsi_Host *shost);

extern void scsi_eh_wakeup(struct Scsi_Host *shost, unsigned int busy);

extern void scsi_eh_scmd_add(struct scsi_cmnd *);

void scsi_eh_ready_devs(struct Scsi_Host *shost,

			struct list_head *work_q,