From owner-svn-src-head@freebsd.org Wed Nov 13 01:58:43 2019 Return-Path: Delivered-To: svn-src-head@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id CE0BF179CC0; Wed, 13 Nov 2019 01:58:43 +0000 (UTC) (envelope-from imp@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 47CSSz53Gtz4NdH; Wed, 13 Nov 2019 01:58:43 +0000 (UTC) (envelope-from imp@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 8C5A88EFB; Wed, 13 Nov 2019 01:58:43 +0000 (UTC) (envelope-from imp@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id xAD1wh09064564; Wed, 13 Nov 2019 01:58:43 GMT (envelope-from imp@FreeBSD.org) Received: (from imp@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id xAD1whMM064563; Wed, 13 Nov 2019 01:58:43 GMT (envelope-from imp@FreeBSD.org) Message-Id: <201911130158.xAD1whMM064563@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: imp set sender to imp@FreeBSD.org using -f From: Warner Losh Date: Wed, 13 Nov 2019 01:58:43 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r354668 - head/sys/cam/scsi X-SVN-Group: head X-SVN-Commit-Author: imp X-SVN-Commit-Paths: head/sys/cam/scsi X-SVN-Commit-Revision: 354668 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Nov 2019 01:58:43 -0000 Author: imp Date: Wed Nov 13 01:58:43 2019 New Revision: 354668 URL: https://svnweb.freebsd.org/changeset/base/354668 Log: Fix a race between daopen and damediapoll When we do a daopen, we call dareprobe and wait for the results. The repoll runs the da state machine up through the DA_STATE_RC* and then exits. For removable media, we poll the device every 3 seconds with a TUR to see if it has disappeared. This introduces a race. If the removable device has lots of partitions, and if it's a little slow (like say a USB2 connected USB stick), then we can have a fair amount of time that this reporbe is going on for. If, during that time, damediapoll fires, it calls daschedule which changes the scheduling priority from NONE to NORMAL. When that happens, the careful single stepping in the da state machine is disrupted and we wind up sceduling multiple read capacity calls. The first one succeeds and releases the reference. The second one succeeds and releases the reference (and panics if the right code is compiled into the da driver). To avoid the race, only do the TUR calls while in state normal, otherwise just reschedule damediapoll. This prevents the race from happening. Modified: head/sys/cam/scsi/scsi_da.c Modified: head/sys/cam/scsi/scsi_da.c ============================================================================== --- head/sys/cam/scsi/scsi_da.c Wed Nov 13 00:53:45 2019 (r354667) +++ head/sys/cam/scsi/scsi_da.c Wed Nov 13 01:58:43 2019 (r354668) @@ -5949,6 +5949,7 @@ damediapoll(void *arg) if (!cam_iosched_has_work_flags(softc->cam_iosched, DA_WORK_TUR) && (softc->flags & DA_FLAG_TUR_PENDING) == 0 && + softc->state == DA_STATE_NORMAL && LIST_EMPTY(&softc->pending_ccbs)) { if (da_periph_acquire(periph, DA_REF_TUR) == 0) { cam_iosched_set_work_flags(softc->cam_iosched, DA_WORK_TUR);