Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

scsi: atari_scsi: Fix race condition between .queuecommand and EH

It is possible that bus_reset_cleanup() or .eh_abort_handler could be
invoked during NCR5380_queuecommand(). If that takes place before the new
command is enqueued and after the ST-DMA "lock" has been acquired, the
ST-DMA "lock" will be released again. This will result in a lost DMA
interrupt and a command timeout. Fix this by excluding EH and interrupt
handlers while the new command is enqueued.

Link: https://lore.kernel.org/r/af25163257796b50bb99d4ede4025cea55787b8f.1605847196.git.fthain@telegraphics.com.au
Tested-by: Michael Schmitz <schmitzmic@gmail.com>
Reviewed-by: Michael Schmitz <schmitzmic@gmail.com>
Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

authored by

Finn Thain and committed by
Martin K. Petersen
03fe6a64 66df79cc

+9 -10
+6 -3
drivers/scsi/NCR5380.c
··· 580 580 581 581 cmd->result = 0; 582 582 583 - if (!NCR5380_acquire_dma_irq(instance)) 584 - return SCSI_MLQUEUE_HOST_BUSY; 585 - 586 583 spin_lock_irqsave(&hostdata->lock, flags); 584 + 585 + if (!NCR5380_acquire_dma_irq(instance)) { 586 + spin_unlock_irqrestore(&hostdata->lock, flags); 587 + 588 + return SCSI_MLQUEUE_HOST_BUSY; 589 + } 587 590 588 591 /* 589 592 * Insert the cmd into the issue queue. Note that REQUEST SENSE
+3 -7
drivers/scsi/atari_scsi.c
··· 376 376 if (IS_A_TT()) 377 377 return 1; 378 378 379 - if (stdma_is_locked_by(scsi_falcon_intr) && 380 - instance->hostt->can_queue > 1) 379 + if (stdma_is_locked_by(scsi_falcon_intr)) 381 380 return 1; 382 381 383 - if (in_interrupt()) 384 - return stdma_try_lock(scsi_falcon_intr, instance); 385 - 386 - stdma_lock(scsi_falcon_intr, instance); 387 - return 1; 382 + /* stdma_lock() may sleep which means it can't be used here */ 383 + return stdma_try_lock(scsi_falcon_intr, instance); 388 384 } 389 385 390 386 #ifndef MODULE