Bug 718387

Summary: block/cfq-iosched.c:2776 invoked rcu_dereference_check() without protection!
Product: [Fedora] Fedora Reporter: Amit Shah <amit.shah>
Component: kernelAssignee: Kernel Maintainer List <kernel-maint>
Status: CLOSED RAWHIDE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: rawhideCC: amit.shah, aquini, gansalmon, itamar, jmoyer, jonathan, kernel-maint, madhu.chinakonda, vgoyal
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2011-07-11 21:05:58 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Amit Shah 2011-07-02 09:44:01 UTC
Running 3.0-0.rc5.git0.1.fc16.x86_64 on F15.  I got this:

Description of problem:
[ 3465.914487] 
[ 3465.914490] ===================================================
[ 3465.914497] [ INFO: suspicious rcu_dereference_check() usage. ]
[ 3465.914503] ---------------------------------------------------
[ 3465.914510] block/cfq-iosched.c:2776 invoked rcu_dereference_check() without protection!
[ 3465.914516] 
[ 3465.914517] other info that might help us debug this:
[ 3465.914520] 
[ 3465.914525] 
[ 3465.914527] rcu_scheduler_active = 1, debug_locks = 0
[ 3465.914534] 3 locks held by scsi_scan_6/2097:
[ 3465.914539]  #0:  (&shost->scan_mutex){+.+.+.}, at: [<ffffffff8133d968>] scsi_scan_host_selected+0xbf/0x191
[ 3465.914560]  #1:  (&eq->sysfs_lock){+.+...}, at: [<ffffffff8123902a>] elevator_exit+0x1d/0x4e
[ 3465.914577]  #2:  (&(&q->__queue_lock)->rlock){-.-...}, at: [<ffffffff8125032f>] cfq_exit_queue+0x47/0x179
[ 3465.914592] 
[ 3465.914594] stack backtrace:
[ 3465.914601] Pid: 2097, comm: scsi_scan_6 Not tainted 3.0-0.rc5.git0.1.fc16.x86_64 #1
[ 3465.914606] Call Trace:
[ 3465.914616]  [<ffffffff81086e4d>] lockdep_rcu_dereference+0xa8/0xb0
[ 3465.914626]  [<ffffffff81250227>] __cfq_exit_single_io_context+0x78/0xd7
[ 3465.914635]  [<ffffffff81250353>] cfq_exit_queue+0x6b/0x179
[ 3465.914643]  [<ffffffff8123903e>] elevator_exit+0x31/0x4e
[ 3465.914652]  [<ffffffff8123d501>] blk_cleanup_queue+0x4f/0x68
[ 3465.914662]  [<ffffffff8133b931>] scsi_free_queue+0xe/0x10
[ 3465.914671]  [<ffffffff8133efb2>] __scsi_remove_device+0xac/0xb9
[ 3465.914681]  [<ffffffff8133cee8>] scsi_probe_and_add_lun+0xa6e/0xaab
[ 3465.914692]  [<ffffffff8133d5ff>] __scsi_scan_target+0x580/0x5d2
[ 3465.914702]  [<ffffffff81088007>] ? mark_lock+0x2d/0x220
[ 3465.914712]  [<ffffffff81089654>] ? mark_held_locks+0x4b/0x6d
[ 3465.914723]  [<ffffffff814f35d0>] ? _raw_spin_unlock_irqrestore+0x45/0x52
[ 3465.914731]  [<ffffffff81089781>] ? trace_hardirqs_on_caller+0x10b/0x12f
[ 3465.914740]  [<ffffffff8133d6a8>] scsi_scan_channel.part.2+0x57/0x72
[ 3465.914748]  [<ffffffff8133d9b2>] scsi_scan_host_selected+0x109/0x191
[ 3465.914756]  [<ffffffff8133daaf>] ? do_scsi_scan_host+0x75/0x75
[ 3465.914764]  [<ffffffff8133daaa>] do_scsi_scan_host+0x70/0x75
[ 3465.914771]  [<ffffffff8133dad2>] do_scan_async+0x23/0x142
[ 3465.914779]  [<ffffffff8133daaf>] ? do_scsi_scan_host+0x75/0x75
[ 3465.914786]  [<ffffffff8133daaf>] ? do_scsi_scan_host+0x75/0x75
[ 3465.914795]  [<ffffffff810745e1>] kthread+0xa8/0xb0
[ 3465.914807]  [<ffffffff814fb324>] kernel_thread_helper+0x4/0x10
[ 3465.914816]  [<ffffffff814f39d4>] ? retint_restore_args+0x13/0x13
[ 3465.914824]  [<ffffffff81074539>] ? __init_kthread_worker+0x5a/0x5a
[ 3465.914832]  [<ffffffff814fb320>] ? gs_change+0x13/0x13

Comment 1 Vivek Goyal 2011-07-05 20:12:15 UTC
Following fix is in Jens's block tree "for-linus" branch.

commit 3181faa85bda3dc3f5e630a1846526c9caaa38e3
Author: Shaohua Li <shaohua.li>
Date:   Mon Jun 27 09:03:47 2011 +0200

    cfq-iosched: fix a rcu warning
    
    I got a rcu warnning at boot. the ioc->ioc_data is rcu_deferenced, but
    doesn't hold rcu_read_lock.

This is yet to make its way into linus's tree.