Commit 7568615c authored by Tony Battersby's avatar Tony Battersby Committed by James Bottomley

sg: fix unkillable I/O wait deadlock with scsi-mq

When using the write()/read() interface for submitting commands, the
SCSI generic driver does not call blk_put_request() on a completed SCSI
command until userspace calls read() to get the command completion.
Since scsi-mq uses a fixed number of preallocated requests, this makes
it possible for userspace to exhaust the entire preallocated supply of
requests.  For places in the kernel that call blk_get_request() with
GFP_KERNEL, this can cause the calling process to deadlock in a
permanent unkillable I/O wait in blk_get_request() -> ... -> bt_get().
For places in the kernel that call blk_get_request() with GFP_ATOMIC,
this can cause blk_get_request() always to return -EWOULDBLOCK.  Note
that these problems happen only if scsi-mq is enabled.  Prevent the
problems by calling blk_put_request() as soon as the SCSI command
completes instead of waiting for userspace to call read().

Cc: <stable@vger.kernel.org> # 3.17+
Signed-off-by: default avatarTony Battersby <tonyb@cybernetics.com>
Acked-by: default avatarDouglas Gilbert <dgilbert@interlog.com>
Tested-by: default avatarDouglas Gilbert <dgilbert@interlog.com>
Signed-off-by: default avatarJames Bottomley <JBottomley@Parallels.com>
parent 3b524a68
...@@ -1335,6 +1335,17 @@ sg_rq_end_io(struct request *rq, int uptodate) ...@@ -1335,6 +1335,17 @@ sg_rq_end_io(struct request *rq, int uptodate)
} }
/* Rely on write phase to clean out srp status values, so no "else" */ /* Rely on write phase to clean out srp status values, so no "else" */
/*
* Free the request as soon as it is complete so that its resources
* can be reused without waiting for userspace to read() the
* result. But keep the associated bio (if any) around until
* blk_rq_unmap_user() can be called from user context.
*/
srp->rq = NULL;
if (rq->cmd != rq->__cmd)
kfree(rq->cmd);
__blk_put_request(rq->q, rq);
write_lock_irqsave(&sfp->rq_list_lock, iflags); write_lock_irqsave(&sfp->rq_list_lock, iflags);
if (unlikely(srp->orphan)) { if (unlikely(srp->orphan)) {
if (sfp->keep_orphan) if (sfp->keep_orphan)
...@@ -1762,10 +1773,10 @@ sg_finish_rem_req(Sg_request *srp) ...@@ -1762,10 +1773,10 @@ sg_finish_rem_req(Sg_request *srp)
SCSI_LOG_TIMEOUT(4, sg_printk(KERN_INFO, sfp->parentdp, SCSI_LOG_TIMEOUT(4, sg_printk(KERN_INFO, sfp->parentdp,
"sg_finish_rem_req: res_used=%d\n", "sg_finish_rem_req: res_used=%d\n",
(int) srp->res_used)); (int) srp->res_used));
if (srp->rq) { if (srp->bio)
if (srp->bio) ret = blk_rq_unmap_user(srp->bio);
ret = blk_rq_unmap_user(srp->bio);
if (srp->rq) {
if (srp->rq->cmd != srp->rq->__cmd) if (srp->rq->cmd != srp->rq->__cmd)
kfree(srp->rq->cmd); kfree(srp->rq->cmd);
blk_put_request(srp->rq); blk_put_request(srp->rq);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment