[PATCH] scsi: target: core: annotate LUN hlist traversals
Runyu Xiao <[email protected]> Thu, 25 Jun 2026 19:38:07 +0800
| Newsgroups | org.kernel.vger.target-devel,org.kernel.vger.linux-kernel,org.kernel.vger.linux-scsi |
|---|---|
| Message-ID | <[email protected]> |
Some target-core writer-side helpers walk RCU hlist state while already holding the mutex that serializes the operation: core_free_device_list_for_node() holds nacl->lun_entry_mutex core_clear_lun_from_tpg() holds nacl->lun_entry_mutex core_tpg_add_node_to_devs() holds tpg->tpg_lun_mutex The code already uses the same lockdep condition for the rcu_dereference_check() of lun->lun_se_dev in core_tpg_add_node_to_devs(). Pass the corresponding mutex condition to the RCU hlist iterators as well so CONFIG_PROVE_RCU_LIST can see the non-RCU protection. This was found by our static analysis tool and then manually reviewed against the current tree. In the reviewed CONFIG_PROVE_RCU_LIST triage runs, the LUN hlist walkers produced the expected "RCU-list traversed in non-reader section!!" warning with stacks matching core_free_device_list_for_node(), core_clear_lun_from_tpg(), and core_tpg_add_node_to_devs(). The change is limited to documenting the existing protection contract. This is a lockdep annotation cleanup. It does not change LUN list lifetime or serialization. Signed-off-by: Runyu Xiao <[email protected]> --- drivers/target/target_core_device.c | 6 ++++-- drivers/target/target_core_tpg.c | 3 ++- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c index 9db2201aa553..82aa831c69c9 100644 --- a/drivers/target/target_core_device.c +++ b/drivers/target/target_core_device.c @@ -237,7 +237,8 @@ void core_free_device_list_for_node( struct se_dev_entry *deve; mutex_lock(&nacl->lun_entry_mutex); - hlist_for_each_entry_rcu(deve, &nacl->lun_entry_hlist, link) + hlist_for_each_entry_rcu(deve, &nacl->lun_entry_hlist, link, + lockdep_is_held(&nacl->lun_entry_mutex)) core_disable_device_list_for_node(deve->se_lun, deve, nacl, tpg); mutex_unlock(&nacl->lun_entry_mutex); } @@ -483,7 +484,8 @@ void core_clear_lun_from_tpg(struct se_lun *lun, struct se_portal_group *tpg) list_for_each_entry(nacl, &tpg->acl_node_list, acl_list) { mutex_lock(&nacl->lun_entry_mutex); - hlist_for_each_entry_rcu(deve, &nacl->lun_entry_hlist, link) { + hlist_for_each_entry_rcu(deve, &nacl->lun_entry_hlist, link, + lockdep_is_held(&nacl->lun_entry_mutex)) { if (lun != deve->se_lun) continue; diff --git a/drivers/target/target_core_tpg.c b/drivers/target/target_core_tpg.c index ccff9f6e4826..74bfcaa11188 100644 --- a/drivers/target/target_core_tpg.c +++ b/drivers/target/target_core_tpg.c @@ -111,7 +111,8 @@ void core_tpg_add_node_to_devs( struct se_device *dev; mutex_lock(&tpg->tpg_lun_mutex); - hlist_for_each_entry_rcu(lun, &tpg->tpg_lun_hlist, link) { + hlist_for_each_entry_rcu(lun, &tpg->tpg_lun_hlist, link, + lockdep_is_held(&tpg->tpg_lun_mutex)) { if (lun_orig && lun != lun_orig) continue; -- 2.34.1