Commit 71a00593 authored by Finn Thain's avatar Finn Thain Committed by Martin K. Petersen
Browse files

ncr5380: Dont re-enter NCR5380_select() 



Calling NCR5380_select() from the abort handler causes various problems.
Firstly, it means potentially re-entering NCR5380_select(). Secondly, it
means that the lock is released, which permits the EH handlers to be
re-entered. The combination results in crashes. Don't do it.

Fixes: 8b00c3d5 ("ncr5380: Implement new eh_abort_handler")
Reported-and-tested-by: default avatarMichael Schmitz <schmitzmic@gmail.com>
Cc: <stable@vger.kernel.org> # 4.5
Signed-off-by: default avatarFinn Thain <fthain@telegraphics.com.au>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent 1678847e

drivers/scsi/NCR5380.c

+8 −8
Original line number Diff line number Diff line
@@ -2302,6 +2302,9 @@ static bool list_del_cmd(struct list_head *haystack, 
 * If cmd was not found at all then presumably it has already been completed,

 * in which case return SUCCESS to try to avoid further EH measures.

 * If the command has not completed yet, we must not fail to find it.

 *

 * The lock protects driver data structures, but EH handlers also use it

 * to serialize their own execution and prevent their own re-entry.

 */



static int NCR5380_abort(struct scsi_cmnd *cmd)
@@ -2338,15 +2341,12 @@ static int NCR5380_abort(struct scsi_cmnd *cmd) 
	if (list_del_cmd(&hostdata->disconnected, cmd)) {

		dsprintk(NDEBUG_ABORT, instance,

		         "abort: removed %p from disconnected list\n", cmd);

		cmd->result = DID_ERROR << 16;

		if (!hostdata->connected)

			NCR5380_select(instance, cmd);

		if (hostdata->connected != cmd) {

			complete_cmd(instance, cmd);

		/* Can't call NCR5380_select() and send ABORT because that

		 * means releasing the lock. Need a bus reset.

		 */

		result = FAILED;

		goto out;

	}

	}



	if (hostdata->connected == cmd) {

		dsprintk(NDEBUG_ABORT, instance, "abort: cmd %p is connected\n", cmd);

drivers/scsi/atari_NCR5380.c

+8 −8
Original line number Diff line number Diff line
@@ -2497,6 +2497,9 @@ static bool list_del_cmd(struct list_head *haystack, 
 * If cmd was not found at all then presumably it has already been completed,

 * in which case return SUCCESS to try to avoid further EH measures.

 * If the command has not completed yet, we must not fail to find it.

 *

 * The lock protects driver data structures, but EH handlers also use it

 * to serialize their own execution and prevent their own re-entry.

 */



static int NCR5380_abort(struct scsi_cmnd *cmd)
@@ -2533,15 +2536,12 @@ static int NCR5380_abort(struct scsi_cmnd *cmd) 
	if (list_del_cmd(&hostdata->disconnected, cmd)) {

		dsprintk(NDEBUG_ABORT, instance,

		         "abort: removed %p from disconnected list\n", cmd);

		cmd->result = DID_ERROR << 16;

		if (!hostdata->connected)

			NCR5380_select(instance, cmd);

		if (hostdata->connected != cmd) {

			complete_cmd(instance, cmd);

		/* Can't call NCR5380_select() and send ABORT because that

		 * means releasing the lock. Need a bus reset.

		 */

		result = FAILED;

		goto out;

	}

	}



	if (hostdata->connected == cmd) {

		dsprintk(NDEBUG_ABORT, instance, "abort: cmd %p is connected\n", cmd);

CRA Git | Maintained and supported by SUSTech CRA and CCSE