diff options
| author | Finn Thain <fthain@telegraphics.com.au> | 2016-02-23 10:07:06 +1100 |
|---|---|---|
| committer | Martin K. Petersen <martin.petersen@oracle.com> | 2016-03-01 09:38:14 -0500 |
| commit | 71a00593ec0c2e2c1720e4041cf2926ff1d07826 (patch) | |
| tree | b2ce847507a10dfc62cbdac8fb76809c6e62ac82 /drivers/scsi | |
| parent | 1678847ec93040ae8280d19c42ae0ba8a4233e6d (diff) | |
ncr5380: Dont re-enter NCR5380_select()
Calling NCR5380_select() from the abort handler causes various problems.
Firstly, it means potentially re-entering NCR5380_select(). Secondly, it
means that the lock is released, which permits the EH handlers to be
re-entered. The combination results in crashes. Don't do it.
Fixes: 8b00c3d5d40d ("ncr5380: Implement new eh_abort_handler")
Reported-and-tested-by: Michael Schmitz <schmitzmic@gmail.com>
Cc: <stable@vger.kernel.org> # 4.5
Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Diffstat (limited to 'drivers/scsi')
| -rw-r--r-- | drivers/scsi/NCR5380.c | 16 | ||||
| -rw-r--r-- | drivers/scsi/atari_NCR5380.c | 16 |
2 files changed, 16 insertions, 16 deletions
diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c index 0e00d487ceb4..5daab045c063 100644 --- a/drivers/scsi/NCR5380.c +++ b/drivers/scsi/NCR5380.c @@ -2302,6 +2302,9 @@ static bool list_del_cmd(struct list_head *haystack, * If cmd was not found at all then presumably it has already been completed, * in which case return SUCCESS to try to avoid further EH measures. * If the command has not completed yet, we must not fail to find it. + * + * The lock protects driver data structures, but EH handlers also use it + * to serialize their own execution and prevent their own re-entry. */ static int NCR5380_abort(struct scsi_cmnd *cmd) @@ -2338,14 +2341,11 @@ static int NCR5380_abort(struct scsi_cmnd *cmd) if (list_del_cmd(&hostdata->disconnected, cmd)) { dsprintk(NDEBUG_ABORT, instance, "abort: removed %p from disconnected list\n", cmd); - cmd->result = DID_ERROR << 16; - if (!hostdata->connected) - NCR5380_select(instance, cmd); - if (hostdata->connected != cmd) { - complete_cmd(instance, cmd); - result = FAILED; - goto out; - } + /* Can't call NCR5380_select() and send ABORT because that + * means releasing the lock. Need a bus reset. + */ + result = FAILED; + goto out; } if (hostdata->connected == cmd) { diff --git a/drivers/scsi/atari_NCR5380.c b/drivers/scsi/atari_NCR5380.c index d382e71f4f4e..19a2fb3e6e7f 100644 --- a/drivers/scsi/atari_NCR5380.c +++ b/drivers/scsi/atari_NCR5380.c @@ -2497,6 +2497,9 @@ static bool list_del_cmd(struct list_head *haystack, * If cmd was not found at all then presumably it has already been completed, * in which case return SUCCESS to try to avoid further EH measures. * If the command has not completed yet, we must not fail to find it. + * + * The lock protects driver data structures, but EH handlers also use it + * to serialize their own execution and prevent their own re-entry. */ static int NCR5380_abort(struct scsi_cmnd *cmd) @@ -2533,14 +2536,11 @@ static int NCR5380_abort(struct scsi_cmnd *cmd) if (list_del_cmd(&hostdata->disconnected, cmd)) { dsprintk(NDEBUG_ABORT, instance, "abort: removed %p from disconnected list\n", cmd); - cmd->result = DID_ERROR << 16; - if (!hostdata->connected) - NCR5380_select(instance, cmd); - if (hostdata->connected != cmd) { - complete_cmd(instance, cmd); - result = FAILED; - goto out; - } + /* Can't call NCR5380_select() and send ABORT because that + * means releasing the lock. Need a bus reset. + */ + result = FAILED; + goto out; } if (hostdata->connected == cmd) { |