From patchwork Tue Oct 24 15:51:38 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: John Garry X-Patchwork-Id: 116962 Delivered-To: patch@linaro.org Received: by 10.140.22.164 with SMTP id 33csp5914742qgn; Tue, 24 Oct 2017 08:07:17 -0700 (PDT) X-Google-Smtp-Source: ABhQp+RaV9Jm7UF1yJkIjlILxI8cHKvn2yJSonE1KaAZR6C9sAyHMqWsvAPNqvLZ4Z4yoIRez4a0 X-Received: by 10.99.186.6 with SMTP id k6mr14969636pgf.195.1508857637074; Tue, 24 Oct 2017 08:07:17 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1508857637; cv=none; d=google.com; s=arc-20160816; b=cIyLQM31dSuBxUYjbLibWoVWRCc8i0gKAt006xxiJ4dVkZHDOlH2ht618Jmr5i1q2C ZIG4Pdcv38FNpgJqe4KYE7DTr3+nXZXsP/+D3XfYpv5Wv8Vnp1jb3KXtl+WE6PpA7ihT sEFETTbRbUjuByjRNY6FMEUO0gvxCsIPy3tIJWiLtZZv1K4Z8lEGQhjZI1J6SgRSbjSt NUVz5jry6kNskMLQx75tUAMhrmRAR6AsctSFTJpW2eCajquYUeO+ycTUEeAXOLiPpgL0 tqoJ6LZOlU15aKHCL8TYo1QdgCohrjDfUEa09cwjKedMXton+kAVj4bO7vUaN2kN0a9z jBsA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:arc-authentication-results; bh=N4z60oTWqQOANfmabdbZzBWb1YxVEwk6UF26l3lhrAQ=; b=BkX6vStmlzPKetZW6ehlgH3EYGlj6NKuDIYX6JmCEwoapBYWCjicDaL5q2YOsiOqd1 HhMrfS4OkhQ9W6dxUg+G0hNyO/9biea2ETA7ybzK/bD5h0JbtCdelYOvgDCN0Ioi8IJB lng7Z8r0gDI0R3fEMshOqpNp9b0GUo40FpwIbMppWWgW0Yx4/RVx9BmQYEM9m07D6Blx NLcjQHOx5xUXGWZ9VF19Jt5D/72qg42D5TpV8tAqzxiRNulZf9750EEw1mfqma0AJIGX e6xSpE0ivXKlWSMvr3U77ZuT7BrrOkkS0p3mOzcVWR842RifqT296Vsn6c4whYP+Z+SG J/XQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-scsi-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-scsi-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id m23si299677pgc.492.2017.10.24.08.07.16; Tue, 24 Oct 2017 08:07:17 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-scsi-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-scsi-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-scsi-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932403AbdJXPHQ (ORCPT + 1 other); Tue, 24 Oct 2017 11:07:16 -0400 Received: from szxga06-in.huawei.com ([45.249.212.32]:50508 "EHLO huawei.com" rhost-flags-OK-FAIL-OK-FAIL) by vger.kernel.org with ESMTP id S1751398AbdJXPF2 (ORCPT ); Tue, 24 Oct 2017 11:05:28 -0400 Received: from DGGEMS406-HUB.china.huawei.com (unknown [172.30.72.58]) by Forcepoint Email with ESMTP id E7585C3017A17; Tue, 24 Oct 2017 23:05:22 +0800 (CST) Received: from localhost.localdomain (10.67.212.75) by DGGEMS406-HUB.china.huawei.com (10.3.19.206) with Microsoft SMTP Server id 14.3.361.1; Tue, 24 Oct 2017 23:05:17 +0800 From: John Garry To: , CC: , , , , Xiaofei Tan , John Garry Subject: [PATCH 08/19] scsi: hisi_sas: fix the risk of freeing slot twice Date: Tue, 24 Oct 2017 23:51:38 +0800 Message-ID: <1508860309-212397-9-git-send-email-john.garry@huawei.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1508860309-212397-1-git-send-email-john.garry@huawei.com> References: <1508860309-212397-1-git-send-email-john.garry@huawei.com> MIME-Version: 1.0 X-Originating-IP: [10.67.212.75] X-CFilter-Loop: Reflected Sender: linux-scsi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-scsi@vger.kernel.org From: Xiaofei Tan The function hisi_sas_slot_task_free() is used to free the slot and do tidy-up of LLDD resources. The LLDD generally should know the state of a slot and decide when to free it, and it should only be done once. For some scenarios, we really don't know the state, like when TMF timeout. In this case, we check task->lldd_task before calling hisi_sas_slot_task_free(). However, we may miss some scenarios when we should also check task->lldd_task, and it is not SMP safe to check task->lldd_task as we don't protect it within spin lock. This patch is to fix this risk of freeing slot twice, as follows: 1. Check task->lldd_task in the hisi_sas_slot_task_free(), and give up freeing of this time if task->lldd_task is NULL. 2. Set slot->buf to NULL after it is freed. Signed-off-by: Xiaofei Tan Signed-off-by: John Garry --- drivers/scsi/hisi_sas/hisi_sas_main.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) -- 1.9.1 diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c index 2a209e1..6b4dabde 100644 --- a/drivers/scsi/hisi_sas/hisi_sas_main.c +++ b/drivers/scsi/hisi_sas/hisi_sas_main.c @@ -185,13 +185,16 @@ void hisi_sas_slot_task_free(struct hisi_hba *hisi_hba, struct sas_task *task, struct domain_device *device = task->dev; struct hisi_sas_device *sas_dev = device->lldd_dev; + if (!task->lldd_task) + return; + + task->lldd_task = NULL; + if (!sas_protocol_ata(task->task_proto)) if (slot->n_elem) dma_unmap_sg(dev, task->scatter, slot->n_elem, task->data_dir); - task->lldd_task = NULL; - if (sas_dev) atomic64_dec(&sas_dev->running_req); } @@ -199,8 +202,8 @@ void hisi_sas_slot_task_free(struct hisi_hba *hisi_hba, struct sas_task *task, if (slot->buf) dma_pool_free(hisi_hba->buffer_pool, slot->buf, slot->buf_dma); - list_del_init(&slot->entry); + slot->buf = NULL; slot->task = NULL; slot->port = NULL; hisi_sas_slot_index_free(hisi_hba, slot->idx);