【openEuler-1.0-LTS】scsi: core: Fix race between handling STS_RESOURCE and completion

问题复现：

内核补丁：做两件事情
1. 加延时
2. scsi_queue_rq模拟返回DEV_RESOURCE错误
```
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 05b9dd39e06e..25839a9f4917 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -1319,6 +1319,24 @@ bool blk_mq_dispatch_rq_list(struct request_queue *q, struct list_head *list,
         */
        if (!list_empty(list)) {
                bool needs_restart;
+               int run_queue = 0;
+               static unsigned long ji;
+
+               if (!ji)
+                       ji = jiffies;
+
+               needs_restart = blk_mq_sched_needs_restart(hctx);
+               if (!needs_restart ||
+                   (no_tag && list_empty_careful(&hctx->dispatch_wait.entry)))
+                       run_queue = 1;
+               else if (needs_restart && (ret == BLK_STS_RESOURCE ||
+                                          no_budget_avail))
+                       run_queue = 2;
+               else if (ji + 100 * HZ < jiffies) {
+                       printk("%s: delay 10s before add back to dispatch list\n", __func__);
+                       mdelay(10000);
+                       printk("%s: delay done\n", __func__);
+               }

spin_lock(&hctx->lock);
                list_splice_tail_init(list, &hctx->dispatch);
@@ -1358,13 +1376,12 @@ bool blk_mq_dispatch_rq_list(struct request_queue *q, struct list_head *list,
                 * that could otherwise occur if the queue is idle.  We'll do
                 * similar if we couldn't get budget and SCHED_RESTART is set.
                 */
-               needs_restart = blk_mq_sched_needs_restart(hctx);
-               if (!needs_restart ||
-                   (no_tag && list_empty_careful(&hctx->dispatch_wait.entry)))
+               if (run_queue == 1)
                        blk_mq_run_hw_queue(hctx, true);
-               else if (needs_restart && (ret == BLK_STS_RESOURCE ||
-                                          no_budget_avail))
+               else if (run_queue == 2)
                        blk_mq_delay_run_hw_queue(hctx, BLK_MQ_RESOURCE_DELAY);
+               else
+                       printk("%s: dispatch failed, run_queue is not called\n", __func__);

blk_mq_update_dispatch_busy(hctx, true);
                return false;
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 63a2c4635d54..4d8896d14154 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1524,6 +1524,17 @@ static void scsi_softirq_done(struct request *rq)
        unsigned long wait_for = (cmd->allowed + 1) * rq->timeout;
        int disposition;

+       static unsigned long ji;
+
+       if (!ji)
+               ji = jiffies;
+
+       if (ji + 100 * HZ < jiffies) {
+               printk("%s: delay 100ms before complete io\n", __func__);
+               mdelay(100);
+               printk("%s: delay done\n", __func__);
+       }
+
        INIT_LIST_HEAD(&cmd->eh_entry);

atomic_inc(&cmd->device->iodone_cnt);
@@ -1786,6 +1797,11 @@ static blk_status_t scsi_queue_rq(struct blk_mq_hw_ctx *hctx,
        scsi_init_cmd_errh(cmd);
        cmd->scsi_done = scsi_mq_done;

+       if (atomic_read(&sdev->device_busy) > 1) {
+               ret = BLK_STS_RESOURCE;
+               goto out_dec_host_busy;
+       }
+
        reason = scsi_dispatch_cmd(cmd);
        if (reason) {
                scsi_set_blocked(cmd, reason);
```
测试用例：
```
dd if=/dev/sda of=/dev/null iflag=direct bs=4k count=1 &
pid=$!
sync /dev/sda
wait $pid
```
复现结果：
```
 INFO: task dd:13404 blocked for more than 120 seconds.
       Not tainted 4.18.0 #71
 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
 Call Trace:
  ? __schedule+0x45a/0xeb0
  ? schedule+0x80/0xe0
  ? io_schedule+0x22/0x50
  ? __blkdev_direct_IO_simple+0x283/0x4e0
  ? bdput+0x20/0x20
  ? mntput+0x28/0x50
  ? blkdev_direct_IO+0x377/0x620
  ? current_time+0x5f/0xd0
  ? atime_needs_update+0x9f/0x200
  ? touch_atime+0x3b/0x130
  ? generic_file_read_iter+0x9a/0x1060
  ? __handle_mm_fault+0xf70/0x1ab0
  ? blkdev_read_iter+0x41/0x60
  ? new_sync_read+0x161/0x200
  ? __vfs_read+0x39/0x60
  ? vfs_read+0xa5/0x1d0
  ? ksys_read+0x63/0x100
  ? __x64_sys_read+0x1e/0x30
  ? do_syscall_64+0x91/0x360
  ? entry_SYSCALL_64_after_hwframe+0x65/0xca
```
背景知识：
queue_rq 下发rq到驱动有两种错误码：
1）BLK_STS_RESOURCE：表示资源不足(内存不足等)，块层会保证再次尝试下发
2) BLK_STS_DEV_RESOURCE：表示硬件相关资源不足，块层不保证再次下发，需要硬件资源释放后(一般是io完成）主动触发run_queue去下发io

问题根因：
```
t1: 下发io1             t2：下发io2
submit_bio
 ...
 scsi_mq_get_budget
  scsi_dev_queue_ready
   atomic_inc_return(&sdev->device_busy)
 scsi_queue_rq -> 成功
                        submit_bio
                        ┊...
                        ┊blk_mq_dispatch_rq_list
                        ┊ scsi_queue_rq
                        ┊  scsi_dispatch_cmd -> 返回错误
                        ┊  ret = BLK_STS_RESOURCE
                        ┊  if (atomic_read(&sdev->device_busy))
                        ┊   ret = BLK_STS_DEV_RESOURCE
t3：完成io1
//此时dispatch链表为空
//io1完成触发的run_queue
//无法下发io2
                        ┊list_splice_tail_init(list, &hctx->dispatch);
                        ┊//处理BLK_STS_DEV_RESOURCE错误
                        ┊//block层不会再去run_queue
                        ┊//io2将无法下发
```
根因在于scsi_queue_rq，在device_busy非0时将错误BLK_STS_RESOURCE重写为了BLK_STS_DEV_RESOURCE，导致并发场景下io无法下发

GVP openEuler/kernel

内容风险标识

评论 (1)

GVPopenEuler/kernel

内容风险标识