Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

RDMA/srp: Rework SCSI device reset handling

Since .scsi_done() must only be called after scsi_queue_rq() has
finished, make sure that the SRP initiator driver does not call
.scsi_done() while scsi_queue_rq() is in progress. Although
invoking sg_reset -d while I/O is in progress works fine with kernel
v4.20 and before, that is not the case with kernel v5.0-rc1. This
patch avoids that the following crash is triggered with kernel
v5.0-rc1:

BUG: unable to handle kernel NULL pointer dereference at 0000000000000138
CPU: 0 PID: 360 Comm: kworker/0:1H Tainted: G B 5.0.0-rc1-dbg+ #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
Workqueue: kblockd blk_mq_run_work_fn
RIP: 0010:blk_mq_dispatch_rq_list+0x116/0xb10
Call Trace:
blk_mq_sched_dispatch_requests+0x2f7/0x300
__blk_mq_run_hw_queue+0xd6/0x180
blk_mq_run_work_fn+0x27/0x30
process_one_work+0x4f1/0xa20
worker_thread+0x67/0x5b0
kthread+0x1cf/0x1f0
ret_from_fork+0x24/0x30

Cc: <stable@vger.kernel.org>
Fixes: 94a9174c630c ("IB/srp: reduce lock coverage of command completion")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>

authored by

Bart Van Assche and committed by
Jason Gunthorpe
48396e80 8834f560

-10
-10
drivers/infiniband/ulp/srp/ib_srp.c
··· 3032 3032 { 3033 3033 struct srp_target_port *target = host_to_target(scmnd->device->host); 3034 3034 struct srp_rdma_ch *ch; 3035 - int i, j; 3036 3035 u8 status; 3037 3036 3038 3037 shost_printk(KERN_ERR, target->scsi_host, "SRP reset_device called\n"); ··· 3042 3043 return FAILED; 3043 3044 if (status) 3044 3045 return FAILED; 3045 - 3046 - for (i = 0; i < target->ch_count; i++) { 3047 - ch = &target->ch[i]; 3048 - for (j = 0; j < target->req_ring_size; ++j) { 3049 - struct srp_request *req = &ch->req_ring[j]; 3050 - 3051 - srp_finish_req(ch, req, scmnd->device, DID_RESET << 16); 3052 - } 3053 - } 3054 3046 3055 3047 return SUCCESS; 3056 3048 }