diff options
| author | Bart Van Assche <bvanassche@acm.org> | 2022-10-18 13:29:49 -0700 |
|---|---|---|
| committer | Bart Van Assche <bvanassche@google.com> | 2023-03-15 23:30:58 +0000 |
| commit | ead1623c40c827813751709c3f443d26737eddee (patch) | |
| tree | 0db3ee5aee56b41982d2917adb220c736a684359 | |
| parent | 2dfd9ebb22fdca8ade97d106cb6f92618800663f (diff) | |
| download | common-ead1623c40c827813751709c3f443d26737eddee.tar.gz | |
UPSTREAM: scsi: core: Fix a race between scsi_done() and scsi_timeout()
If there is a race between scsi_done() and scsi_timeout() and if
scsi_timeout() loses the race, scsi_timeout() should not reset the request
timer. Hence change the return value for this case from BLK_EH_RESET_TIMER
into BLK_EH_DONE.
Although the block layer holds a reference on a request (req->ref) while
calling a timeout handler, restarting the timer (blk_add_timer()) while a
request is being completed is racy.
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Cc: Keith Busch <kbusch@kernel.org>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Ming Lei <ming.lei@redhat.com>
Cc: John Garry <john.garry@huawei.com>
Cc: Hannes Reinecke <hare@suse.de>
Reported-by: Adrian Hunter <adrian.hunter@intel.com>
Fixes: 15f73f5b3e59 ("blk-mq: move failure injection out of blk_mq_complete_request")
Change-Id: Ieb21c5f31aa2da6971d915ec3db8003bef797c45
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Link: https://lore.kernel.org/r/20221018202958.1902564-2-bvanassche@acm.org
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Bug: 258442751
Bug: 273761554
(cherry picked from commit 978b7922d3dca672b41bb4b8ce6c06ab77112741)
Signed-off-by: Bart Van Assche <bvanassche@google.com>
| -rw-r--r-- | drivers/scsi/scsi_error.c | 14 |
1 files changed, 3 insertions, 11 deletions
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c index cfa588e91561..5013327e6939 100644 --- a/drivers/scsi/scsi_error.c +++ b/drivers/scsi/scsi_error.c @@ -306,19 +306,11 @@ enum blk_eh_timer_return scsi_times_out(struct request *req) if (rtn == BLK_EH_DONE) { /* - * Set the command to complete first in order to prevent a real - * completion from releasing the command while error handling - * is using it. If the command was already completed, then the - * lower level driver beat the timeout handler, and it is safe - * to return without escalating error recovery. - * - * If timeout handling lost the race to a real completion, the - * block layer may ignore that due to a fake timeout injection, - * so return RESET_TIMER to allow error handling another shot - * at this command. + * If scsi_done() has already set SCMD_STATE_COMPLETE, do not + * modify *scmd. */ if (test_and_set_bit(SCMD_STATE_COMPLETE, &scmd->state)) - return BLK_EH_RESET_TIMER; + return BLK_EH_DONE; if (scsi_abort_command(scmd) != SUCCESS) { set_host_byte(scmd, DID_TIME_OUT); scsi_eh_scmd_add(scmd); |