From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,MAILING_LIST_MULTI, SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8A7EDC433E0 for ; Wed, 30 Dec 2020 13:24:26 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 4ED3922225 for ; Wed, 30 Dec 2020 13:24:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726957AbgL3NYU (ORCPT ); Wed, 30 Dec 2020 08:24:20 -0500 Received: from mx2.suse.de ([195.135.220.15]:46906 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726594AbgL3NYU (ORCPT ); Wed, 30 Dec 2020 08:24:20 -0500 X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.221.27]) by mx2.suse.de (Postfix) with ESMTP id 77B2BABA1; Wed, 30 Dec 2020 13:23:38 +0000 (UTC) Date: Wed, 30 Dec 2020 14:23:37 +0100 From: Daniel Wagner To: Chaitanya Kulkarni Cc: Enzo Matsumiya , "linux-nvme@lists.infradead.org" , Jens Axboe , Keith Busch , Christoph Hellwig , Sagi Grimberg , "linux-kernel@vger.kernel.org" Subject: Re: [PATCH] nvme: hwmon: fix crash on device teardown Message-ID: <20201230132337.svr2rlygfeofd45q@beryllium.lan> References: <20201209213228.5044-1-ematsumiya@suse.de> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hi Chaitanya, On Thu, Dec 10, 2020 at 04:35:14AM +0000, Chaitanya Kulkarni wrote: > Enzo, > On 12/9/20 13:39, Enzo Matsumiya wrote: > > Fix a possible NULL pointer dereference when trying to read > > hwmon sysfs entries associated to NVMe-oF devices that were > > hot-removed or disconnected. > > > > Unregister the NVMe hwmon device upon controller teardown > > (nvme_stop_ctrl()). > > > > Signed-off-by: Enzo Matsumiya > (Without looking into the code) > > Do you have blktests testcases for NVMeOFhot-removed and disconnected > device scenario to produce the problem ? Here is a rough blktests' test to reproduce the problem. There is clearly a race as the crash not always happens at the same iteration. On my system I was able to hit consistently within 50 iterations. Maybe you need to tweak it on your system to reproduce it. Thanks, Daniel #!/bin/bash # SPDX-License-Identifier: GPL-2.0+ # Copyright (c) 2020 SUSE LLC # # Test NVMeOF read hwmon device info . tests/nvme/rc DESCRIPTION="read hwmon device info" requires() { _nvme_requires _have_modules loop _require_nvme_trtype_is_fabrics } _get_nvme_hwmon_devs() { echo "/sys/devices/virtual/nvme-fabrics/ctl/hwmon*" } _read_nvme_hwmon_attr() { hwmon_devs="$(_get_nvme_hwmon_devs)" for hwmon in "${hwmon_devs}"; do cat ${hwmon}"/name" cat ${hwmon}"/temp1_label" cat ${hwmon}"/temp1_alarm" cat ${hwmon}"/temp1_input" done } test() { echo "Running ${TEST_NAME}" _setup_nvmet local port local loop_dev local file_path="$TMPDIR/img" local subsys_name="blktests-subsystem-1" truncate -s 1G "${file_path}" loop_dev="$(losetup -f --show "${file_path}")" _create_nvmet_subsystem "${subsys_name}" "${loop_dev}" \ "91fdba0d-f87b-4c25-b80f-db7be1418b9e" port="$(_create_nvmet_port "${nvme_trtype}")" _add_nvmet_subsys_to_port "${port}" "${subsys_name}" for i in $(seq 1 50); do _nvme_connect_subsys "${nvme_trtype}" "${subsys_name}" _read_nvme_hwmon_attr _nvme_disconnect_subsys "${subsys_name}" _read_nvme_hwmon_attr done _remove_nvmet_subsystem_from_port "${port}" "${subsys_name}" _remove_nvmet_subsystem "${subsys_name}" _remove_nvmet_port "${port}" losetup -d "${loop_dev}" rm "${file_path}" echo "Test complete" }