Hi
[1.] One line summary of the problem:
scsi_done from qla2x00_sp_compl race with scsi_queue_insert from scmd_eh_abort_handler()
then cause the BUG_ON(blk_queued_rq(req)) trigger.
[2.] Full description of the problem/report:
The detailed scene is as following:
cpu A cpu B
kworker interrupt
scmd_eh_abort_handler()
-> scsi_try_to_abort_cmd() qla2x00_status_entry()
-> qla2xxx_eh_abort() -> res = DID_RESET << 16 //case CS_ABORTED
-> qla2x00_eh_wait_on_command() -> qla2x00_sp_compl()
>>>> +-> cmd->result = res; // --->P0_B
while (CMD_SP(cmd) && wait_iter--) { +-> qla2x00_sp_free_dma()
msleep(ABORT_POLLING_PERIOD); | -> CMD_SP(cmd) = NULL
} |
>>>> |
-> scsi_noretry_cmd() //--->P2_A |
-> scsi_queue_insert() +-> scsi_done()
-> __scsi_queue_insert() -> blk_complete_request()
-> cmd->result = 0; // --->P0_A |
-> blk_requeue_request() |
-> blk_clear_rq_complete() // --->P1_A |
-> elv_requeue_request() |
-> __elv_add_request() +-> blk_mark_rq_complete() // ----> P1_B
// req will be queued here +-> __blk_complete_request()
BLK_SOFTIRQ
scsi_softirq_done()
-> scsi_decide_disposition() // ----> P2_B
// scsi_cmnd->result is set to 0 in P0_A
// so it will return SUCCESS
-> scsi_finish_command()
-> scsi_io_completion()
-> scsi_end_request()
-> blk_finish_request() // BUG_ON(blk_queued_rq(req)) !!!
The scsi_cmd->result was set to DID_RESET << 16 at P0_B.
At P2_A, the scsi_noretry_cmd() would return 0 and scsi_queue_insert() would be invoked.
When the blk_clear_rq_complete() at P1_A was invoked before the blk_mark_rq_complete()
at P1_B, __blk_complete_request() would be invoked in cpu B.
At P2_B, the scsi_decide_disposition() will return SUCCESS as the scsi_cmd->result had been set to 0 at P0_A.
Finally, the BUG_ON(blk_queued_rq(req)) in blk_finish_request() was triggered.
Whether the scsi_done should be invoked in qla2xxx_sp_compl() when scsi_cmd is aborted ?
When the P1_B is before P1_A, it will do nothing, otherwise, the panic comes up.
Thanks
Jianchao
