From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:45582 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752564AbcDIXpy (ORCPT ); Sat, 9 Apr 2016 19:45:54 -0400 Subject: Patch "ncr5380: Dont re-enter NCR5380_select()" has been added to the 4.5-stable tree To: fthain@telegraphics.com.au, gregkh@linuxfoundation.org, martin.petersen@oracle.com, schmitzmic@gmail.com Cc: , From: Date: Sat, 09 Apr 2016 16:45:52 -0700 Message-ID: <1460245552207248@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled ncr5380: Dont re-enter NCR5380_select() to the 4.5-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: ncr5380-dont-re-enter-ncr5380_select.patch and it can be found in the queue-4.5 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From 71a00593ec0c2e2c1720e4041cf2926ff1d07826 Mon Sep 17 00:00:00 2001 From: Finn Thain Date: Tue, 23 Feb 2016 10:07:06 +1100 Subject: ncr5380: Dont re-enter NCR5380_select() From: Finn Thain commit 71a00593ec0c2e2c1720e4041cf2926ff1d07826 upstream. Calling NCR5380_select() from the abort handler causes various problems. Firstly, it means potentially re-entering NCR5380_select(). Secondly, it means that the lock is released, which permits the EH handlers to be re-entered. The combination results in crashes. Don't do it. Fixes: 8b00c3d5d40d ("ncr5380: Implement new eh_abort_handler") Reported-and-tested-by: Michael Schmitz Signed-off-by: Finn Thain Signed-off-by: Martin K. Petersen Signed-off-by: Greg Kroah-Hartman --- drivers/scsi/NCR5380.c | 16 ++++++++-------- drivers/scsi/atari_NCR5380.c | 16 ++++++++-------- 2 files changed, 16 insertions(+), 16 deletions(-) --- a/drivers/scsi/NCR5380.c +++ b/drivers/scsi/NCR5380.c @@ -2302,6 +2302,9 @@ static bool list_del_cmd(struct list_hea * If cmd was not found at all then presumably it has already been completed, * in which case return SUCCESS to try to avoid further EH measures. * If the command has not completed yet, we must not fail to find it. + * + * The lock protects driver data structures, but EH handlers also use it + * to serialize their own execution and prevent their own re-entry. */ static int NCR5380_abort(struct scsi_cmnd *cmd) @@ -2338,14 +2341,11 @@ static int NCR5380_abort(struct scsi_cmn if (list_del_cmd(&hostdata->disconnected, cmd)) { dsprintk(NDEBUG_ABORT, instance, "abort: removed %p from disconnected list\n", cmd); - cmd->result = DID_ERROR << 16; - if (!hostdata->connected) - NCR5380_select(instance, cmd); - if (hostdata->connected != cmd) { - complete_cmd(instance, cmd); - result = FAILED; - goto out; - } + /* Can't call NCR5380_select() and send ABORT because that + * means releasing the lock. Need a bus reset. + */ + result = FAILED; + goto out; } if (hostdata->connected == cmd) { --- a/drivers/scsi/atari_NCR5380.c +++ b/drivers/scsi/atari_NCR5380.c @@ -2497,6 +2497,9 @@ static bool list_del_cmd(struct list_hea * If cmd was not found at all then presumably it has already been completed, * in which case return SUCCESS to try to avoid further EH measures. * If the command has not completed yet, we must not fail to find it. + * + * The lock protects driver data structures, but EH handlers also use it + * to serialize their own execution and prevent their own re-entry. */ static int NCR5380_abort(struct scsi_cmnd *cmd) @@ -2533,14 +2536,11 @@ static int NCR5380_abort(struct scsi_cmn if (list_del_cmd(&hostdata->disconnected, cmd)) { dsprintk(NDEBUG_ABORT, instance, "abort: removed %p from disconnected list\n", cmd); - cmd->result = DID_ERROR << 16; - if (!hostdata->connected) - NCR5380_select(instance, cmd); - if (hostdata->connected != cmd) { - complete_cmd(instance, cmd); - result = FAILED; - goto out; - } + /* Can't call NCR5380_select() and send ABORT because that + * means releasing the lock. Need a bus reset. + */ + result = FAILED; + goto out; } if (hostdata->connected == cmd) { Patches currently in stable-queue which might be from fthain@telegraphics.com.au are queue-4.5/ncr5380-correctly-clear-command-pointers-and-lists-after-bus-reset.patch queue-4.5/ncr5380-call-scsi_eh_prep_cmnd-and-scsi_eh_restore_cmnd-as-and-when-appropriate.patch queue-4.5/ncr5380-forget-aborted-commands.patch queue-4.5/ncr5380-dont-release-lock-for-pio-transfer.patch queue-4.5/ncr5380-dont-re-enter-ncr5380_select.patch queue-4.5/ncr5380-fix-ncr5380_select-eh-checks-and-result-handling.patch