Patch "ncr5380: Dont re-enter NCR5380_select()" has been added to the 4.5-stable tree

PATCH [email protected] 1 participant 1 message Apr 9, 2016

Subsystems (3)

Stable branch SCSI Ncr 5380 SCSI drivers

lore

Share & tools

lore

[email protected]

author maintainer Applied

2016-04-09 23:45 UTC #0 lore raw

This is a note to let you know that I've just added the patch titled

    ncr5380: Dont re-enter NCR5380_select()

to the 4.5-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:

     ncr5380-dont-re-enter-ncr5380_select.patch

and it can be found in the queue-4.5 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From 71a00593ec0c2e2c1720e4041cf2926ff1d07826 Mon Sep 17 00:00:00 2001

From: Finn Thain <[email protected]>
Date: Tue, 23 Feb 2016 10:07:06 +1100
Subject: ncr5380: Dont re-enter NCR5380_select()

From: Finn Thain <[email protected]>

commit 71a00593ec0c2e2c1720e4041cf2926ff1d07826 upstream.

Calling NCR5380_select() from the abort handler causes various problems. Firstly, it means potentially re-entering NCR5380_select(). Secondly, it means that the lock is released, which permits the EH handlers to be re-entered. The combination results in crashes. Don't do it.

Fixes 8b00c3d5d40d ("ncr5380: Implement new eh_abort_handler")

Reported-and-tested-by Michael Schmitz <[email protected]>

Signed-off-by Finn Thain <[email protected]>

Signed-off-by Martin K. Petersen <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/scsi/NCR5380.c       |   16 ++++++++--------
 drivers/scsi/atari_NCR5380.c |   16 ++++++++--------
 2 files changed, 16 insertions(+), 16 deletions(-)

drivers/scsi/NCR5380.c +8 -8

@@ -2302,6 +2302,9 @@ static bool list_del_cmd(struct list_hea
  * If cmd was not found at all then presumably it has already been completed,
  * in which case return SUCCESS to try to avoid further EH measures.
  * If the command has not completed yet, we must not fail to find it.
+ *
+ * The lock protects driver data structures, but EH handlers also use it
+ * to serialize their own execution and prevent their own re-entry.
  */
 
 static int NCR5380_abort(struct scsi_cmnd *cmd)

@@ -2338,14 +2341,11 @@ static int NCR5380_abort(struct scsi_cmn
 	if (list_del_cmd(&hostdata->disconnected, cmd)) {
 		dsprintk(NDEBUG_ABORT, instance,
 		         "abort: removed %p from disconnected list\n", cmd);
-		cmd->result = DID_ERROR << 16;
-		if (!hostdata->connected)
-			NCR5380_select(instance, cmd);
-		if (hostdata->connected != cmd) {
-			complete_cmd(instance, cmd);
-			result = FAILED;
-			goto out;
-		}
+		/* Can't call NCR5380_select() and send ABORT because that
+		 * means releasing the lock. Need a bus reset.
+		 */
+		result = FAILED;
+		goto out;
 	}
 
 	if (hostdata->connected == cmd) {

drivers/scsi/atari_NCR5380.c +8 -8

@@ -2497,6 +2497,9 @@ static bool list_del_cmd(struct list_hea
  * If cmd was not found at all then presumably it has already been completed,
  * in which case return SUCCESS to try to avoid further EH measures.
  * If the command has not completed yet, we must not fail to find it.
+ *
+ * The lock protects driver data structures, but EH handlers also use it
+ * to serialize their own execution and prevent their own re-entry.
  */
 
 static int NCR5380_abort(struct scsi_cmnd *cmd)

@@ -2533,14 +2536,11 @@ static int NCR5380_abort(struct scsi_cmn
 	if (list_del_cmd(&hostdata->disconnected, cmd)) {
 		dsprintk(NDEBUG_ABORT, instance,
 		         "abort: removed %p from disconnected list\n", cmd);
-		cmd->result = DID_ERROR << 16;
-		if (!hostdata->connected)
-			NCR5380_select(instance, cmd);
-		if (hostdata->connected != cmd) {
-			complete_cmd(instance, cmd);
-			result = FAILED;
-			goto out;
-		}
+		/* Can't call NCR5380_select() and send ABORT because that
+		 * means releasing the lock. Need a bus reset.
+		 */
+		result = FAILED;
+		goto out;
 	}
 
 	if (hostdata->connected == cmd) {

Patches currently in stable-queue which might be from [email protected] are

queue-4.5/ncr5380-correctly-clear-command-pointers-and-lists-after-bus-reset.patch queue-4.5/ncr5380-call-scsi_eh_prep_cmnd-and-scsi_eh_restore_cmnd-as-and-when-appropriate.patch queue-4.5/ncr5380-forget-aborted-commands.patch queue-4.5/ncr5380-dont-release-lock-for-pio-transfer.patch queue-4.5/ncr5380-dont-re-enter-ncr5380_select.patch queue-4.5/ncr5380-fix-ncr5380_select-eh-checks-and-result-handling.patch