Message ID | 1675261833-2-1-git-send-email-lizhijian@fujitsu.com |
---|---|
State | New |
Headers |
Return-Path: <linux-kernel-owner@vger.kernel.org> Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:eb09:0:0:0:0:0 with SMTP id s9csp316242wrn; Wed, 1 Feb 2023 06:42:00 -0800 (PST) X-Google-Smtp-Source: AK7set+x9jBE7ScW8+sYP7OLAueQexEaeWTMZGUOd1yXWcEROF/EAzr467URAryXxnJUaPKBzOmp X-Received: by 2002:a17:906:2496:b0:86f:5636:4712 with SMTP id e22-20020a170906249600b0086f56364712mr2526200ejb.7.1675262520482; Wed, 01 Feb 2023 06:42:00 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1675262520; cv=none; d=google.com; s=arc-20160816; b=SfYm+7QKzt8E+qrgR9aPpD8SpepUB9D+KwdLr0ytjpOHk0rBCYwTxJJGPeg6JG0Ujv 1p15cnaCNfynKPvYflZmClayWELcIgOIrl6D3i34cPyIlepX+9x1bN4pDm5T/HMp3rc5 v1Zlda/Ldin/1JAtTiNTLPTDgpcu6/be5bW7D2atcs73niZEEclWvciz9qwdbv/2pXLs nbrx5YXjpP5YHdpYmlGn2EdXua5e4utTtBR/tPIYLiTwgmIDyCmQSfP640ZpAF3CMDNh 6v5cD5JM7lMa8YGwd5YWMAHFv75J/IqgfkDuGj0UFXwumQm+3sR+19H5jX4DFdEkQSlP 8vMw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:mime-version:message-id:date:subject:cc:to:from :dkim-signature; bh=0ZDzmk/46NIteFVAff959RyjgW31rh1zhUtYYCkV5hk=; b=pOnNkF3ZKwsWX3FQxptgn40xbQvaBRS9f9bHqfxvVYIsJX7cB1ZDZWG1v6A1bI8tJx te2NS1sXOOxV4MosOhiX5cWQAkOjRA7Ky2oeCSxkHqC+Bo6MZfhILQF3oIS5FirsGr1R haaFXT6FeW+rlY1a0eVED+FptAjIogCf6/5RypF4vOJ2lZIcCIbIc03x4opW14k0Nyy5 hH9TH79KbW8JHSqsTVnFTciXa9mIc/j4zIn4+ZiBKwOybIEujZ5DuXa0Wt4bWEi18UrU J6eCa3u7LOex3E508oIKHv5q8+PjMUPHjqRmge9Ovx1AsazgTozmHCPK+dNiD2ZRSr61 uw7A== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@fujitsu.com header.s=170520fj header.b=esPXAnOJ; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=fujitsu.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id c20-20020a1709063f1400b0084d1a2c5a0asi5353083ejj.937.2023.02.01.06.41.36; Wed, 01 Feb 2023 06:42:00 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@fujitsu.com header.s=170520fj header.b=esPXAnOJ; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=fujitsu.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232377AbjBAObB (ORCPT <rfc822;duw91626@gmail.com> + 99 others); Wed, 1 Feb 2023 09:31:01 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42034 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231302AbjBAOa7 (ORCPT <rfc822;linux-kernel@vger.kernel.org>); Wed, 1 Feb 2023 09:30:59 -0500 Received: from mail1.bemta34.messagelabs.com (mail1.bemta34.messagelabs.com [195.245.231.4]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 94877C161; Wed, 1 Feb 2023 06:30:57 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fujitsu.com; s=170520fj; t=1675261856; i=@fujitsu.com; bh=0ZDzmk/46NIteFVAff959RyjgW31rh1zhUtYYCkV5hk=; h=From:To:CC:Subject:Date:Message-ID:MIME-Version:Content-Type; b=esPXAnOJMYtx3QqOwNFcer1ITu+62ZTn6x+Pk5fjZVN1knR/Ju31awhxNklp4yAwB aAhpvwAEI0yC3z+xjOStOjqTKJNBa3EuNrZh9uF/1uVJvyjYfo5eize+2ZNpCFCrXN zvXSrgFWZA6X4QhpfuJGGZEdsrD6qCmWXZhON7N46xgKUMJKKjzisD8b1ymF2NT8TD pg3qwujS/cxPnGuN1WW+XNJ04HlaVcl8LOa1x+FGIj29m7XvrepqkzovLMf0NNkoED B0bsai0fBSEKoxSfOZgLkhA5ZqnqzKQV0JGS5ywEFUcyZcaXpiRJ7eg48/A6Yxkd+K HdOjD12WmWnug== X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFnrNIsWRWlGSWpSXmKPExsViZ8ORqDu//Fa ywaR1khY3pslZbDu9gd1i5owTjBZvN01hsZjyaymzxeVdc9gsnh3qZXFg9zj95g6Tx6ZVnWwe CxumMnt83iTnsfXzbZYA1ijWzLyk/IoE1oye19MZCx7LVGxbf5+5gfGNRBcjF4eQwBZGiR23V rFAOCuYJJbfe8MI4RxglHg86TJbFyMnB5uAhsS9lpuMILaIQJDE0jWvmUCKmAVaGSWONE1iBk kIC3hK/L55DcxmEVCReLXkPSuIzSvgKNH59As7iC0hoCAx5eF7Zoi4oMTJmU9YQGxmAQmJgy9 eAMU5gGqUJGZ2x0OUV0q0fvjFAmGrSVw9t4l5AiP/LCTds5B0L2BkWsVoVpxaVJZapGtoqJdU lJmeUZKbmJmjl1ilm6iXWqpbnlpcomukl1herJdaXKxXXJmbnJOil5dasokRGO4pxcoeOxif9 v3VO8QoycGkJMrbkHorWYgvKT+lMiOxOCO+qDQntfgQowwHh5IE784CoJxgUWp6akVaZg4w9m DSEhw8SiK8hoVAad7igsTc4sx0iNQpRl2ODQ8O7GUWYsnLz0uVEuf9VwZUJABSlFGaBzcClgY uMcpKCfMyMjAwCPEUpBblZpagyr9iFOdgVBLm1S8BmsKTmVcCt+kV0BFMQEfctb4JckRJIkJK qoFp+s/1UYeLOwSvpHx1tm7UeHYvfjHDjeKVO82CbJcdYY2eXr5XoWv7yYxUoQmT1Z1l7uSv4 DzdPy03uFvBMHjVd56dj/cIvTbU0r/24syOCF0RXhnrd7s535wQmLp4f9i3G9ZqC/1PsKXtX3 Vuw+3p3022MnG33Ll/rv3jXVczzcapSU465TeW3zlbtfN1rT2n+wKJ8I4LAnZHF4u89T+6eYr dtzA25Wc2e+p2WOnMsttvdML1+tvayf/l9z/68zj7t0Pncqm2+7OusGpEWc42DwgInXa9WUtd fN3C0ETbygeFjldnGrnNeBj6at6ziwvTjy9315+d+aCq6uCCxwtrLNP0NohPutwqzaux2SE4S omlOCPRUIu5qDgRANFsO4J+AwAA X-Env-Sender: lizhijian@fujitsu.com X-Msg-Ref: server-6.tower-571.messagelabs.com!1675261855!123222!1 X-Originating-IP: [62.60.8.97] X-SYMC-ESS-Client-Auth: outbound-route-from=pass X-StarScan-Received: X-StarScan-Version: 9.102.1; banners=-,-,- X-VirusChecked: Checked Received: (qmail 23045 invoked from network); 1 Feb 2023 14:30:55 -0000 Received: from unknown (HELO n03ukasimr01.n03.fujitsu.local) (62.60.8.97) by server-6.tower-571.messagelabs.com with ECDHE-RSA-AES256-GCM-SHA384 encrypted SMTP; 1 Feb 2023 14:30:55 -0000 Received: from n03ukasimr01.n03.fujitsu.local (localhost [127.0.0.1]) by n03ukasimr01.n03.fujitsu.local (Postfix) with ESMTP id 0B959100195; Wed, 1 Feb 2023 14:30:55 +0000 (GMT) Received: from R01UKEXCASM223.r01.fujitsu.local (R01UKEXCASM223 [10.182.185.121]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by n03ukasimr01.n03.fujitsu.local (Postfix) with ESMTPS id EF95F100194; Wed, 1 Feb 2023 14:30:54 +0000 (GMT) Received: from 2754e32d63a1.localdomain (10.167.225.141) by R01UKEXCASM223.r01.fujitsu.local (10.182.185.121) with Microsoft SMTP Server (TLS) id 15.0.1497.42; Wed, 1 Feb 2023 14:30:51 +0000 From: Li Zhijian <lizhijian@fujitsu.com> To: <haris.iqbal@ionos.com>, <jinpu.wang@ionos.com>, <linux-rdma@vger.kernel.org> CC: <jgg@ziepe.ca>, <leon@kernel.org>, <guoqing.jiang@linux.dev>, <linux-kernel@vger.kernel.org>, Li Zhijian <lizhijian@fujitsu.com> Subject: [PATCH RFC] RDMA/rtrs: Don't call kobject_del for srv_path->kobj Date: Wed, 1 Feb 2023 14:30:33 +0000 Message-ID: <1675261833-2-1-git-send-email-lizhijian@fujitsu.com> X-Mailer: git-send-email 1.8.3.1 MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [10.167.225.141] X-ClientProxiedBy: G08CNEXCHPEKD07.g08.fujitsu.local (10.167.33.80) To R01UKEXCASM223.r01.fujitsu.local (10.182.185.121) X-Virus-Scanned: ClamAV using ClamSMTP X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: <linux-kernel.vger.kernel.org> X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1756640072589826308?= X-GMAIL-MSGID: =?utf-8?q?1756640072589826308?= |
Series |
[RFC] RDMA/rtrs: Don't call kobject_del for srv_path->kobj
|
|
Commit Message
Zhijian Li (Fujitsu)
Feb. 1, 2023, 2:30 p.m. UTC
As the mention in commmit f7452a7e96c1 ("RDMA/rtrs-srv: fix memory leak by missing kobject free"),
it's intended to remove the kobject_del for srv_path->kobj.
A kernel panic will be triggered by following script
-----------------------
$ while true;
do
echo "sessname=foo path=ip:<ip address> device_path=/dev/nvme0n1" > /sys/devices/virtual/rnbd-client/ctl/map_device
echo "normal" > /sys/block/rnbd0/rnbd/unmap_device
done
-----------------------
The bisection pointed to commit 6af4609c18b3 ("RDMA/rtrs-srv: Fix several issues in rtrs_srv_destroy_path_files")
at last.
rnbd_server L777: </dev/nvme0n1@foo>: Opened device 'nvme0n1'
general protection fault, probably for non-canonical address 0x765f766564753aea: 0000 [#1] PREEMPT SMP PTI
CPU: 0 PID: 3558 Comm: systemd-udevd Kdump: loaded Not tainted 6.1.0-rc3-roce-flush+ #51
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
RIP: 0010:kernfs_dop_revalidate+0x36/0x180
Code: 00 00 41 55 41 54 55 53 48 8b 47 68 48 89 fb 48 85 c0 0f 84 db 00 00 00 48 8b a8 60 04 00 00 48 8b 45 30 48 85 c0 48 0f 44 c5 <4c> 8b 60 78 49 81 c4 d8 00 00 00 4c 89 e7 e8 b7 78 7b 00 8b 05 3d
RSP: 0018:ffffaf1700b67c78 EFLAGS: 00010206
RAX: 765f766564753a72 RBX: ffff89e2830849c0 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff89e2830849c0
RBP: ffff89e280361bd0 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000065 R11: 0000000000000000 R12: ffff89e2830849c0
R13: ffff89e283084888 R14: d0d0d0d0d0d0d0d0 R15: 2f2f2f2f2f2f2f2f
FS: 00007f13fbce7b40(0000) GS:ffff89e2bbc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f93e055d340 CR3: 0000000104664002 CR4: 00000000001706f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
lookup_fast+0x7b/0x100
walk_component+0x21/0x160
link_path_walk.part.0+0x24d/0x390
path_openat+0xad/0x9a0
do_filp_open+0xa9/0x150
? lock_release+0x13c/0x2e0
? _raw_spin_unlock+0x29/0x50
? alloc_fd+0x124/0x1f0
do_sys_openat2+0x9b/0x160
__x64_sys_openat+0x54/0xa0
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f13fc9d701b
Code: 25 00 00 41 00 3d 00 00 41 00 74 4b 64 8b 04 25 18 00 00 00 85 c0 75 67 44 89 e2 48 89 ee bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 91 00 00 00 48 8b 54 24 28 64 48 2b 14 25
RSP: 002b:00007ffddf242640 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f13fc9d701b
RDX: 0000000000080000 RSI: 00007ffddf2427c0 RDI: 00000000ffffff9c
RBP: 00007ffddf2427c0 R08: 00007f13fcc5b440 R09: 21b2131aa64b1ef2
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000080000
R13: 00007ffddf2427c0 R14: 000055ed13be8db0 R15: 0000000000000000
Fixes: 6af4609c18b3 ("RDMA/rtrs-srv: Fix several issues in rtrs_srv_destroy_path_files")
Signed-off-by: Li Zhijian <lizhijian@fujitsu.com>
---
drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c | 1 -
1 file changed, 1 deletion(-)
Comments
On 2/1/23 22:30, Li Zhijian wrote: > As the mention in commmit f7452a7e96c1 ("RDMA/rtrs-srv: fix memory leak by missing kobject free"), > it's intended to remove the kobject_del for srv_path->kobj. > > A kernel panic will be triggered by following script > ----------------------- > $ while true; > do > echo "sessname=foo path=ip:<ip address> device_path=/dev/nvme0n1" > /sys/devices/virtual/rnbd-client/ctl/map_device > echo "normal" > /sys/block/rnbd0/rnbd/unmap_device > done > ----------------------- > The bisection pointed to commit 6af4609c18b3 ("RDMA/rtrs-srv: Fix several issues in rtrs_srv_destroy_path_files") > at last. > > rnbd_server L777: </dev/nvme0n1@foo>: Opened device 'nvme0n1' > general protection fault, probably for non-canonical address 0x765f766564753aea: 0000 [#1] PREEMPT SMP PTI > CPU: 0 PID: 3558 Comm: systemd-udevd Kdump: loaded Not tainted 6.1.0-rc3-roce-flush+ #51 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 > RIP: 0010:kernfs_dop_revalidate+0x36/0x180 > Code: 00 00 41 55 41 54 55 53 48 8b 47 68 48 89 fb 48 85 c0 0f 84 db 00 00 00 48 8b a8 60 04 00 00 48 8b 45 30 48 85 c0 48 0f 44 c5 <4c> 8b 60 78 49 81 c4 d8 00 00 00 4c 89 e7 e8 b7 78 7b 00 8b 05 3d > RSP: 0018:ffffaf1700b67c78 EFLAGS: 00010206 > RAX: 765f766564753a72 RBX: ffff89e2830849c0 RCX: 0000000000000000 > RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff89e2830849c0 > RBP: ffff89e280361bd0 R08: 0000000000000000 R09: 0000000000000001 > R10: 0000000000000065 R11: 0000000000000000 R12: ffff89e2830849c0 > R13: ffff89e283084888 R14: d0d0d0d0d0d0d0d0 R15: 2f2f2f2f2f2f2f2f > FS: 00007f13fbce7b40(0000) GS:ffff89e2bbc00000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 00007f93e055d340 CR3: 0000000104664002 CR4: 00000000001706f0 > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > Call Trace: > <TASK> > lookup_fast+0x7b/0x100 > walk_component+0x21/0x160 > link_path_walk.part.0+0x24d/0x390 > path_openat+0xad/0x9a0 > do_filp_open+0xa9/0x150 > ? lock_release+0x13c/0x2e0 > ? _raw_spin_unlock+0x29/0x50 > ? alloc_fd+0x124/0x1f0 > do_sys_openat2+0x9b/0x160 > __x64_sys_openat+0x54/0xa0 > do_syscall_64+0x3b/0x90 > entry_SYSCALL_64_after_hwframe+0x63/0xcd > RIP: 0033:0x7f13fc9d701b > Code: 25 00 00 41 00 3d 00 00 41 00 74 4b 64 8b 04 25 18 00 00 00 85 c0 75 67 44 89 e2 48 89 ee bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 91 00 00 00 48 8b 54 24 28 64 48 2b 14 25 > RSP: 002b:00007ffddf242640 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 > RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f13fc9d701b > RDX: 0000000000080000 RSI: 00007ffddf2427c0 RDI: 00000000ffffff9c > RBP: 00007ffddf2427c0 R08: 00007f13fcc5b440 R09: 21b2131aa64b1ef2 > R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000080000 > R13: 00007ffddf2427c0 R14: 000055ed13be8db0 R15: 0000000000000000 > > Fixes: 6af4609c18b3 ("RDMA/rtrs-srv: Fix several issues in rtrs_srv_destroy_path_files") > Signed-off-by: Li Zhijian <lizhijian@fujitsu.com> > --- > drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c | 1 - > 1 file changed, 1 deletion(-) > > diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c b/drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c > index da8e205ce331..7fe905424109 100644 > --- a/drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c > +++ b/drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c > @@ -313,7 +313,6 @@ void rtrs_srv_destroy_path_files(struct rtrs_srv_path *srv_path) > > if (srv_path->kobj.state_in_sysfs) { > sysfs_remove_group(&srv_path->kobj, &rtrs_srv_path_attr_group); > - kobject_del(&srv_path->kobj); > kobject_put(&srv_path->kobj); > } > Thanks for the fix, it would be better to comment that why kobject_del can't be called here. Anyway, Acked-by: Guoqing Jiang <guoqing.jiang@linux.dev> Thanks, Guoqing
Thanks your reviewing @Guoqing > Thanks for the fix, it would be better to comment that why kobject_del can't > be called here. commmit f7452a7e96c1 ("RDMA/rtrs-srv: fix memory leak by missing kobject free") memtioned a free_sess(), but i didn't get it exactly(no such function ?). So i have not sorted it out. And hold on,with below change, kernel gets another WARNING. I'm still working on it. [ 125.034407] ========================= [ 125.035490] WARNING: held lock freed! [ 125.036640] 6.2.0-rc6-roce-flush+ #53 Not tainted [ 125.038088] ------------------------- [ 125.039143] kworker/0:3/63 is freeing memory ffff90bd01eaa000-ffff90bd01eaa7ff, with a lock still held there! [ 125.041660] ffff90bd01eaa118 (&srv->paths_mutex){+.+.}-{3:3}, at: rtrs_srv_destroy_once_sysfs_root_folders.isra.0+0x24/0x60 [rtrs_server] [ 125.044600] 3 locks held by kworker/0:3/63: [ 125.046091] #0: ffff90bd05f8ed38 ((wq_completion)rtrs_server_wq){+.+.}-{0:0}, at: process_one_work+0x1f4/0x590 [ 125.048876] #1: ffff9ff4c085fe78 ((work_completion)(&srv_path->close_work)){+.+.}-{0:0}, at: process_one_work+0x1f4/0x590 [ 125.051789] #2: ffff90bd01eaa118 (&srv->paths_mutex){+.+.}-{3:3}, at: rtrs_srv_destroy_once_sysfs_root_folders.isra.0+0x24/0x60 [rtrs_server] [ 125.055167] [ 125.055167] stack backtrace: [ 125.057979] CPU: 0 PID: 63 Comm: kworker/0:3 Kdump: loaded Not tainted 6.2.0-rc6-roce-flush+ #53 [ 125.060201] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 [ 125.063156] Workqueue: rtrs_server_wq rtrs_srv_close_work [rtrs_server] [ 125.065031] Call Trace: [ 125.065905] <TASK> [ 125.066733] dump_stack_lvl+0x45/0x5d [ 125.068003] debug_check_no_locks_freed.cold+0x77/0x7c [ 125.069565] ? device_release+0x34/0x90 [ 125.070814] __kmem_cache_free+0x74/0x190 [ 125.072059] device_release+0x34/0x90 [ 125.073203] kobject_put+0x8b/0x1d0 [ 125.074385] rtrs_srv_destroy_once_sysfs_root_folders.isra.0+0x35/0x60 [rtrs_server] [ 125.076456] rtrs_srv_close_work+0x21/0x270 [rtrs_server] [ 125.078097] process_one_work+0x274/0x590 [ 125.079372] worker_thread+0x4f/0x3d0 [ 125.080508] ? __pfx_worker_thread+0x10/0x10 [ 125.081751] kthread+0xe7/0x110 [ 125.082778] ? __pfx_kthread+0x10/0x10 [ 125.083894] ret_from_fork+0x2c/0x50 [ 125.084991] </TASK> On 02/02/2023 09:41, Guoqing Jiang wrote: > > > On 2/1/23 22:30, Li Zhijian wrote: >> As the mention in commmit f7452a7e96c1 ("RDMA/rtrs-srv: fix memory leak by missing kobject free"), >> it's intended to remove the kobject_del for srv_path->kobj. >> >> A kernel panic will be triggered by following script >> ----------------------- >> $ while true; >> do >> echo "sessname=foo path=ip:<ip address> device_path=/dev/nvme0n1" > /sys/devices/virtual/rnbd-client/ctl/map_device >> echo "normal" > /sys/block/rnbd0/rnbd/unmap_device >> done >> ----------------------- >> The bisection pointed to commit 6af4609c18b3 ("RDMA/rtrs-srv: Fix several issues in rtrs_srv_destroy_path_files") >> at last. >> >> rnbd_server L777: </dev/nvme0n1@foo>: Opened device 'nvme0n1' >> general protection fault, probably for non-canonical address 0x765f766564753aea: 0000 [#1] PREEMPT SMP PTI >> CPU: 0 PID: 3558 Comm: systemd-udevd Kdump: loaded Not tainted 6.1.0-rc3-roce-flush+ #51 >> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 >> RIP: 0010:kernfs_dop_revalidate+0x36/0x180 >> Code: 00 00 41 55 41 54 55 53 48 8b 47 68 48 89 fb 48 85 c0 0f 84 db 00 00 00 48 8b a8 60 04 00 00 48 8b 45 30 48 85 c0 48 0f 44 c5 <4c> 8b 60 78 49 81 c4 d8 00 00 00 4c 89 e7 e8 b7 78 7b 00 8b 05 3d >> RSP: 0018:ffffaf1700b67c78 EFLAGS: 00010206 >> RAX: 765f766564753a72 RBX: ffff89e2830849c0 RCX: 0000000000000000 >> RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff89e2830849c0 >> RBP: ffff89e280361bd0 R08: 0000000000000000 R09: 0000000000000001 >> R10: 0000000000000065 R11: 0000000000000000 R12: ffff89e2830849c0 >> R13: ffff89e283084888 R14: d0d0d0d0d0d0d0d0 R15: 2f2f2f2f2f2f2f2f >> FS: 00007f13fbce7b40(0000) GS:ffff89e2bbc00000(0000) knlGS:0000000000000000 >> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 >> CR2: 00007f93e055d340 CR3: 0000000104664002 CR4: 00000000001706f0 >> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 >> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 >> Call Trace: >> <TASK> >> lookup_fast+0x7b/0x100 >> walk_component+0x21/0x160 >> link_path_walk.part.0+0x24d/0x390 >> path_openat+0xad/0x9a0 >> do_filp_open+0xa9/0x150 >> ? lock_release+0x13c/0x2e0 >> ? _raw_spin_unlock+0x29/0x50 >> ? alloc_fd+0x124/0x1f0 >> do_sys_openat2+0x9b/0x160 >> __x64_sys_openat+0x54/0xa0 >> do_syscall_64+0x3b/0x90 >> entry_SYSCALL_64_after_hwframe+0x63/0xcd >> RIP: 0033:0x7f13fc9d701b >> Code: 25 00 00 41 00 3d 00 00 41 00 74 4b 64 8b 04 25 18 00 00 00 85 c0 75 67 44 89 e2 48 89 ee bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 91 00 00 00 48 8b 54 24 28 64 48 2b 14 25 >> RSP: 002b:00007ffddf242640 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 >> RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f13fc9d701b >> RDX: 0000000000080000 RSI: 00007ffddf2427c0 RDI: 00000000ffffff9c >> RBP: 00007ffddf2427c0 R08: 00007f13fcc5b440 R09: 21b2131aa64b1ef2 >> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000080000 >> R13: 00007ffddf2427c0 R14: 000055ed13be8db0 R15: 0000000000000000 >> >> Fixes: 6af4609c18b3 ("RDMA/rtrs-srv: Fix several issues in rtrs_srv_destroy_path_files") >> Signed-off-by: Li Zhijian <lizhijian@fujitsu.com> >> --- >> drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c | 1 - >> 1 file changed, 1 deletion(-) >> >> diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c b/drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c >> index da8e205ce331..7fe905424109 100644 >> --- a/drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c >> +++ b/drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c >> @@ -313,7 +313,6 @@ void rtrs_srv_destroy_path_files(struct rtrs_srv_path *srv_path) >> if (srv_path->kobj.state_in_sysfs) { >> sysfs_remove_group(&srv_path->kobj, &rtrs_srv_path_attr_group); >> - kobject_del(&srv_path->kobj); >> kobject_put(&srv_path->kobj); >> } > > Thanks for the fix, it would be better to comment that why kobject_del can't > be called here. > > Anyway, Acked-by: Guoqing Jiang <guoqing.jiang@linux.dev> > > Thanks, > Guoqing
On 2/2/23 11:42, lizhijian@fujitsu.com wrote: > Thanks your reviewing @Guoqing > >> Thanks for the fix, it would be better to comment that why kobject_del can't >> be called here. > commmit f7452a7e96c1 ("RDMA/rtrs-srv: fix memory leak by missing kobject free") > memtioned a free_sess(), but i didn't get it exactly(no such function ?). So i have > not sorted it out. It was renamed to free_path I believe. > And hold on,with below change, kernel gets another WARNING. > I'm still working on it. > > [ 125.034407] ========================= > [ 125.035490] WARNING: held lock freed! > [ 125.036640] 6.2.0-rc6-roce-flush+ #53 Not tainted > [ 125.038088] ------------------------- > [ 125.039143] kworker/0:3/63 is freeing memory ffff90bd01eaa000-ffff90bd01eaa7ff, with a lock still held there! > [ 125.041660] ffff90bd01eaa118 (&srv->paths_mutex){+.+.}-{3:3}, at: rtrs_srv_destroy_once_sysfs_root_folders.isra.0+0x24/0x60 [rtrs_server] > [ 125.044600] 3 locks held by kworker/0:3/63: > [ 125.046091] #0: ffff90bd05f8ed38 ((wq_completion)rtrs_server_wq){+.+.}-{0:0}, at: process_one_work+0x1f4/0x590 > [ 125.048876] #1: ffff9ff4c085fe78 ((work_completion)(&srv_path->close_work)){+.+.}-{0:0}, at: process_one_work+0x1f4/0x590 > [ 125.051789] #2: ffff90bd01eaa118 (&srv->paths_mutex){+.+.}-{3:3}, at: rtrs_srv_destroy_once_sysfs_root_folders.isra.0+0x24/0x60 [rtrs_server] > [ 125.055167] > [ 125.055167] stack backtrace: > [ 125.057979] CPU: 0 PID: 63 Comm: kworker/0:3 Kdump: loaded Not tainted 6.2.0-rc6-roce-flush+ #53 > [ 125.060201] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 > [ 125.063156] Workqueue: rtrs_server_wq rtrs_srv_close_work [rtrs_server] > [ 125.065031] Call Trace: > [ 125.065905] <TASK> > [ 125.066733] dump_stack_lvl+0x45/0x5d > [ 125.068003] debug_check_no_locks_freed.cold+0x77/0x7c > [ 125.069565] ? device_release+0x34/0x90 > [ 125.070814] __kmem_cache_free+0x74/0x190 > [ 125.072059] device_release+0x34/0x90 > [ 125.073203] kobject_put+0x8b/0x1d0 > [ 125.074385] rtrs_srv_destroy_once_sysfs_root_folders.isra.0+0x35/0x60 [rtrs_server] > [ 125.076456] rtrs_srv_close_work+0x21/0x270 [rtrs_server] > [ 125.078097] process_one_work+0x274/0x590 > [ 125.079372] worker_thread+0x4f/0x3d0 > [ 125.080508] ? __pfx_worker_thread+0x10/0x10 > [ 125.081751] kthread+0xe7/0x110 > [ 125.082778] ? __pfx_kthread+0x10/0x10 > [ 125.083894] ret_from_fork+0x2c/0x50 > [ 125.084991] </TASK> Suppose it also happened during run your script, I guess it might be some racy conditions. $ while true; do echo "sessname=foo path=ip:<ip address> device_path=/dev/nvme0n1" > /sys/devices/virtual/rnbd-client/ctl/map_device echo "normal" > /sys/block/rnbd0/rnbd/unmap_device done Or does it disappear after revert 6af4609c18b3? If so, we can revert it first. Thanks, Guoqing
On 02/02/2023 12:09, Guoqing Jiang wrote: >> > > Suppose it also happened during run your script, I guess it might be some > racy conditions. That's true > > $ while true; > do > echo "sessname=foo path=ip:<ip address> device_path=/dev/nvme0n1" > /sys/devices/virtual/rnbd-client/ctl/map_device > echo "normal" > /sys/block/rnbd0/rnbd/unmap_device > done > > > Or does it disappear after revert 6af4609c18b3? If so, we can revert it > first. Well, everything goes well after i reverted 6af4609c18b3. Thanks Zhijian > > Thanks, > Guoqing
On 02/02/2023 15:25, lizhijian@fujitsu.com wrote: > > > On 02/02/2023 12:09, Guoqing Jiang wrote: >>> >> >> Suppose it also happened during run your script, I guess it might be some >> racy conditions. > That's true > > >> >> $ while true; >> do >> echo "sessname=foo path=ip:<ip address> device_path=/dev/nvme0n1" > /sys/devices/virtual/rnbd-client/ctl/map_device >> echo "normal" > /sys/block/rnbd0/rnbd/unmap_device >> done >> >> >> Or does it disappear after revert 6af4609c18b3? If so, we can revert it >> first. > > Well, everything goes well after i reverted 6af4609c18b3. 6af4609c18b3 seems make senses, so i don't want to revert it entirely if possible. I have a update for this path like below, i am no longer get problem with this new update. index c76ba29da1e2..5adba0f754b6 100644 --- a/drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c +++ b/drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c @@ -312,9 +312,8 @@ void rtrs_srv_destroy_path_files(struct rtrs_srv_path *srv_path) if (srv_path->kobj.state_in_sysfs) { sysfs_remove_group(&srv_path->kobj, &rtrs_srv_path_attr_group); - kobject_del(&srv_path->kobj); kobject_put(&srv_path->kobj); + rtrs_srv_destroy_once_sysfs_root_folders(srv_path); } - rtrs_srv_destroy_once_sysfs_root_folders(srv_path); } > > Thanks > Zhijian >> >> Thanks, >> Guoqing
On 2/2/23 15:59, lizhijian@fujitsu.com wrote: > 6af4609c18b3 seems make senses, so i don't want to revert it entirely if possible. > > I have a update for this path like below, i am no longer get problem with this new update. > > index c76ba29da1e2..5adba0f754b6 100644 > --- a/drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c > +++ b/drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c > @@ -312,9 +312,8 @@ void rtrs_srv_destroy_path_files(struct rtrs_srv_path *srv_path) > > if (srv_path->kobj.state_in_sysfs) { > sysfs_remove_group(&srv_path->kobj, &rtrs_srv_path_attr_group); > - kobject_del(&srv_path->kobj); > kobject_put(&srv_path->kobj); > + rtrs_srv_destroy_once_sysfs_root_folders(srv_path); > } > > - rtrs_srv_destroy_once_sysfs_root_folders(srv_path); > } Hmm, I overlooked the kobject hierarchy 😅. err = kobject_init_and_add(&srv_path->kobj, &ktype, srv->kobj_paths, "%s", str); Pls send a formal patch, and feel free to add my Acked-by. Thanks, Guoqing
diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c b/drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c index da8e205ce331..7fe905424109 100644 --- a/drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c +++ b/drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c @@ -313,7 +313,6 @@ void rtrs_srv_destroy_path_files(struct rtrs_srv_path *srv_path) if (srv_path->kobj.state_in_sysfs) { sysfs_remove_group(&srv_path->kobj, &rtrs_srv_path_attr_group); - kobject_del(&srv_path->kobj); kobject_put(&srv_path->kobj); }