Kernel/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-12-29 17:25:38 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

scsi: core: Fix a race between scsi_done() and scsi_timeout()

Browse Source 
If there is a race between scsi_done() and scsi_timeout() and if
scsi_timeout() loses the race, scsi_timeout() should not reset the request
timer. Hence change the return value for this case from BLK_EH_RESET_TIMER
into BLK_EH_DONE.

Although the block layer holds a reference on a request (req->ref) while
calling a timeout handler, restarting the timer (blk_add_timer()) while a
request is being completed is racy.

Reviewed-by: Mike Christie <michael.christie@oracle.com>
Cc: Keith Busch <kbusch@kernel.org>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Ming Lei <ming.lei@redhat.com>
Cc: John Garry <john.garry@huawei.com>
Cc: Hannes Reinecke <hare@suse.de>
Reported-by: Adrian Hunter <adrian.hunter@intel.com>
Fixes: 15f73f5b3e ("blk-mq: move failure injection out of blk_mq_complete_request")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Link: https://lore.kernel.org/r/20221018202958.1902564-2-bvanassche@acm.org
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
This commit is contained in:
Bart Van Assche 2022-10-18 13:29:49 -07:00 committed by Martin K. Petersen
parent 24b3e45ca9
commit 978b7922d3
1 changed files with 3 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
drivers/scsi/scsi_error.c
View File

@ -343,19 +343,11 @@ enum blk_eh_timer_return scsi_timeout(struct request *req)
if (rtn == BLK_EH_DONE) {
/*
* Set the command to complete first in order to prevent a real
* completion from releasing the command while error handling
* is using it. If the command was already completed, then the
* lower level driver beat the timeout handler, and it is safe
* to return without escalating error recovery.
*
* If timeout handling lost the race to a real completion, the
* block layer may ignore that due to a fake timeout injection,
* so return RESET_TIMER to allow error handling another shot
* at this command.
* If scsi_done() has already set SCMD_STATE_COMPLETE, do not
* modify *scmd.
*/
if (test_and_set_bit(SCMD_STATE_COMPLETE, &scmd->state))
return BLK_EH_RESET_TIMER;
return BLK_EH_DONE;
if (scsi_abort_command(scmd) != SUCCESS) {
set_host_byte(scmd, DID_TIME_OUT);
scsi_eh_scmd_add(scmd);