Skip to content

Conversation

@katlapinka
Copy link

@katlapinka katlapinka commented May 20, 2021

Needs #13
Signed-off-by: klapinsk katarzyna.lapinska@intel.com

mmkayPL
mmkayPL previously approved these changes Jun 11, 2021
Deixx
Deixx previously approved these changes Jun 14, 2021
@mmkayPL mmkayPL changed the title Add ocf stress tests [experimental]Add ocf stress tests Jun 14, 2021
@katlapinka katlapinka dismissed stale reviews from Deixx and mmkayPL via 1f5cd16 June 18, 2021 07:19
Signed-off-by: klapinsk <katarzyna.lapinska@intel.com>
robertbaldyga pushed a commit that referenced this pull request Jan 26, 2022
`struct spdk_vhost_dev vdev` in `struct spdk_vhost_scsi_dev` can be
unregistered in `vhost_scsi_dev_remove`, so we can't use it
anymore in other places after `vhost_dev_unregister`.

Ideally `state->remove_cb` should not take the `vdev` as
the input parameter either, but I don't find it's used
anywhere, so leave it unchanged.

==29555==ERROR: AddressSanitizer: heap-use-after-free on address 0x602000006df0
READ of size 2 at 0x602000006df0 thread T0 (reactor_0)
    #0 0x7f3c246c0f0a  (/lib64/libasan.so.5+0x9cf0a)
    #1 0x7f3c246c3c15 in vsnprintf (/lib64/libasan.so.5+0x9fc15)
    #2 0xa55cfa in spdk_vlog /spdk/lib/log/log.c:158
    #3 0xa5596f in spdk_log /spdk/lib/log/log.c:110
    #4 0x842e43 in remove_scsi_tgt /spdk/lib/vhost/vhost_scsi.c:208
    #5 0x851508 in vhost_scsi_dev_remove_tgt_cpl_cb /spdk/lib/vhost/vhost_scsi.c:1149
    #6 0x8383f1 in foreach_session_finish_cb /spdk/lib/vhost/vhost.c:1144
    #7 0x9d3223 in msg_queue_run_batch /spdk/lib/thread/thread.c:703
    #8 0x9d73fe in thread_poll /spdk/lib/thread/thread.c:919
    #9 0x9d7c3b in spdk_thread_poll /spdk/lib/thread/thread.c:979
    #10 0x8812fe in _reactor_run /spdk/lib/event/reactor.c:920
    #11 0x881bf1 in reactor_run /spdk/lib/event/reactor.c:958
    #12 0x88292b in spdk_reactors_start /spdk/lib/event/reactor.c:1060
    #13 0x873ff9 in spdk_app_start /spdk/lib/event/app.c:585
    #14 0x408044 in main /spdk/app/vhost/vhost.c:105
    #15 0x7f3c23691f42 in __libc_start_main (/lib64/libc.so.6+0x23f42)
    #16 0x407add in _start (/spdk/build/bin/vhost+0x407add)

0x602000006df0 is located 0 bytes inside of 8-byte region [0x602000006df0,0x602000006df8)
freed by thread T0 (reactor_0) here:
    #0 0x7f3c2473191f in __interceptor_free (/lib64/libasan.so.5+0x10d91f)
    #1 0x8369f2 in vhost_dev_unregister /spdk/lib/vhost/vhost.c:1024
    #2 0x84f32d in vhost_scsi_dev_remove /spdk/lib/vhost/vhost_scsi.c:913
    #3 0x83cdb7 in spdk_vhost_dev_remove /spdk/lib/vhost/vhost.c:1494
    #4 0x83ed66 in vhost_fini /spdk/lib/vhost/vhost.c:1644
    #5 0x9d3223 in msg_queue_run_batch /spdk/lib/thread/thread.c:703
    #6 0x9d73fe in thread_poll /spdk/lib/thread/thread.c:919
    #7 0x9d7c3b in spdk_thread_poll /spdk/lib/thread/thread.c:979
    #8 0x8812fe in _reactor_run /spdk/lib/event/reactor.c:920
    #9 0x881bf1 in reactor_run /spdk/lib/event/reactor.c:958
    #10 0x88292b in spdk_reactors_start /spdk/lib/event/reactor.c:1060
    #11 0x873ff9 in spdk_app_start /spdk/lib/event/app.c:585
    #12 0x408044 in main /spdk/app/vhost/vhost.c:105
    #13 0x7f3c23691f42 in __libc_start_main (/lib64/libc.so.6+0x23f42)

Change-Id: I511c4316a838cd92961d57c9193d384acd49d760
Signed-off-by: Changpeng Liu <changpeng.liu@intel.com>
Reviewed-on: https://review.spdk.io/gerrit/c/spdk/spdk/+/10141
Community-CI: Broadcom CI <spdk-ci.pdl@broadcom.com>
Community-CI: Mellanox Build Bot
Tested-by: SPDK CI Jenkins <sys_sgci@intel.com>
Reviewed-by: Shuhei Matsumoto <shuhei.matsumoto.xt@hitachi.com>
Reviewed-by: Dong Yi <dongx.yi@intel.com>
Reviewed-by: Jim Harris <james.r.harris@intel.com>
Reviewed-by: Ben Walker <benjamin.walker@intel.com>
rafalste pushed a commit that referenced this pull request Dec 17, 2025
Despite AER handling being synchronous in nvme library, changes on target side
can happen while AER is being handled. Order of operations for AER is:
read log page, identify controller, identify every active namespace.

Right now the buffer from log page is unused, but further down the series
it will be used to select which namespaces to send identify to.
This means that the state could have changed after reading the log page,
but before identifying controller. Resulting in more active namespaces,
than we will be sending identify to.

We can be sure that target has another AER pending for that namespace, with
log page containing it. Yet on the initiator side we cannot assume every nsdata
for every active namespace was filled while processing a single AER.

After using the log page in following patches, this backtrace can be seen:
    #0 0x000000528f50 in spdk_divide_round_up /spdk/aer_handling/include/spdk/util.h:176
    #1 0x00000052d6b0 in raid_bdev_load_base_bdev_superblock /spdk/aer_handling/module/bdev/raid/bdev_raid_sb.c:290
    #2 0x0000005253f4 in raid_bdev_examine_load_sb /spdk/aer_handling/module/bdev/raid/bdev_raid.c:3874
    #3 0x000000525810 in raid_bdev_examine /spdk/aer_handling/module/bdev/raid/bdev_raid.c:3943
    #4 0x000000d72238 in bdev_examine /spdk/aer_handling/lib/bdev/bdev.c:762
    #5 0x000000ddac74 in spdk_bdev_register /spdk/aer_handling/lib/bdev/bdev.c:9116
    #6 0x0000004684e4 in nvme_bdev_create /spdk/aer_handling/module/bdev/nvme/bdev_nvme.c:4710
    #7 0x00000046d1c4 in nvme_ctrlr_populate_namespace /spdk/aer_handling/module/bdev/nvme/bdev_nvme.c:5017
    #8 0x00000046fdac in nvme_ctrlr_populate_namespaces /spdk/aer_handling/module/bdev/nvme/bdev_nvme.c:5195
    #9 0x0000004743a4 in aer_cb /spdk/aer_handling/module/bdev/nvme/bdev_nvme.c:5648
    #10 0x000000b6892c in nvme_ctrlr_process_async_event_finish /spdk/aer_handling/lib/nvme/nvme_ctrlr.c:3198
    #11 0x000000b6a3e0 in nvme_ctrlr_process_async_event /spdk/aer_handling/lib/nvme/nvme_ctrlr.c:3362
    #12 0x000000b6b314 in nvme_ctrlr_complete_queued_async_events /spdk/aer_handling/lib/nvme/nvme_ctrlr.c:3398
    #13 0x000000b7cff4 in spdk_nvme_ctrlr_process_admin_completions /spdk/aer_handling/lib/nvme/nvme_ctrlr.c:4622
    #14 0x0000004428cc in bdev_nvme_poll_adminq /spdk/aer_handling/module/bdev/nvme/bdev_nvme.c:1872

A simple fix for now is to skip namespaces that do not have nsdata filled out,
by using a function that actually checks it - spdk_nvme_ns_is_active().

Change-Id: I07a214c980c22dac4085d2ca3354bd2ba8046687
Signed-off-by: Tomasz Zawadzki <tomasz.zawadzki@nutanix.com>
Reviewed-on: https://review.spdk.io/c/spdk/spdk/+/26496
Reviewed-by: Jacek Kalwas <jacek.kalwas@nutanix.com>
Reviewed-by: Ben Walker <ben@nvidia.com>
Reviewed-by: Jim Harris <jim.harris@nvidia.com>
Tested-by: SPDK Automated Test System <spdkbot@gmail.com>
Community-CI: Mellanox Build Bot
@github-actions
Copy link

SPDK manages code review in https://review.spdk.io. This PR will be closed automatically.

@github-actions github-actions bot added the Stale label Dec 19, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants