A bug in scsi_alloc_target of drivers/scsi/scsi_scan.c

2017-05-09 Thread Dashi DS1 Cao
When debugging a race condition in scsi_remove_target of 3.12, I ran into this possible bug within scsi_alloc_target. When an existing "struct scsi_target" is found and used, the starget just got through kzmalloc should be freed, rather than dong a "put_device(dev)". diff --git a/drivers/scsi/sc

work queue of scsi fc transports should be serialized

2017-05-19 Thread Dashi DS1 Cao
I ran into a series of crashes within scsi_remove_target in SUSE 12 SP1 (3.12.49-11-default). This will happen very easily if there is a lot of disks with many storage and host FC ports. It occurs when all the ports are timeout at the same time. 50 disks for each rports (the same 50 LUNs), 4 rpo

RE: work queue of scsi fc transports should be serialized

2017-05-20 Thread Dashi DS1 Cao
On Fri, 2017-05-19 at 09:36 +, Dashi DS1 Cao wrote: > It seems there is a race of multiple "fc_starget_delete" of the same > rport, thus of the same SCSI host. The race leads to the race of > scsi_remove_target and it cannot be prevented by the code snippet > alone, e