[SCSI] remove a timer race in scsi_queue_insert() (d8c37e7b) · Commits · 戴 / test

scsi_queue_insert() has four callers. Three callers call with timer disabled and one (the second invocation in scsi_dispatch_cmd()) calls with timer activated. scsi_queue_insert() used to always call scsi_delete_timer() and ignore the return value. This results in race with timer expiration. Remove scsi_delete_timer() call from scsi_queue_insert() and make the caller delete timer and check the return value. Signed-off-by:

Tejun Heo <htejun@gmail.com> Signed-off-by:

James Bottomley <James.Bottomley@SteelEye.com>

drivers/scsi/scsi.c

+6 −4

Original line number	Diff line number	Diff line
		@@ -638,10 +638,12 @@ int scsi_dispatch_cmd(struct scsi_cmnd *cmd)
		}
		spin_unlock_irqrestore(host->host_lock, flags);
		if (rtn) {
		if (scsi_delete_timer(cmd)) {
		atomic_inc(&cmd->device->iodone_cnt);
		scsi_queue_insert(cmd,
		(rtn == SCSI_MLQUEUE_DEVICE_BUSY) ?
		rtn : SCSI_MLQUEUE_HOST_BUSY);
		}
		SCSI_LOG_MLQUEUE(3,
		printk("queuecommand : request rejected\n"));
		}

drivers/scsi/scsi_lib.c

+1 −7

Original line number	Diff line number	Diff line
		@@ -128,13 +128,7 @@ int scsi_queue_insert(struct scsi_cmnd *cmd, int reason)
		printk("Inserting command %p into mlqueue\n", cmd));

		/*
		* We are inserting the command into the ml queue. First, we
		* cancel the timer, so it doesn't time out.
		*/
		scsi_delete_timer(cmd);

		/*
		* Next, set the appropriate busy bit for the device/host.
		* Set the appropriate busy bit for the device/host.
		*
		* If the host/device isn't busy, assume that something actually
		* completed, and that we should be able to queue a command now.

Admin message