Re: [PATCH] scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The driver-private retry marker (`this_residual`) is leaked across block layer tag reuses if a command completing with `DID_IMM_RETRY` is terminally completed by the SCSI midlayer. This permanently poisons the tag, disabling AIO bypass for future requests and causing the driver to erroneously offline healthy physical drives on routine errors.
--

--- Patch [1]: [PATCH] scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches ---
commit b11e42cf8728d0b2c04d732af5bc5bfb1648bc25
Author: David Strahan <David.Strahan@microchip.com>

scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches

This patch registers a per-command initialization callback to prevent the
SCSI core from clearing driver private data between dispatches. It allows an
AIO retry marker (this_residual) to survive requeues, with the driver taking
over the responsibility of clearing the marker on terminal completions.

> diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c
> --- a/drivers/scsi/smartpqi/smartpqi_init.c
> +++ b/drivers/scsi/smartpqi/smartpqi_init.c

[ ... ]

> @@ -5958,6 +5964,17 @@ void pqi_prep_for_scsi_done(struct scsi_cmnd *scmd)
>  	struct pqi_scsi_dev *device;
>  	struct completion *wait;
>  
> +	/*
> +	 * Clear the AIO-retry marker on final completion so the tag
> +	 * starts clean on its next dispatch.  On DID_IMM_RETRY leave
> +	 * it intact: pqi_aio_io_complete() sets DID_IMM_RETRY and
> +	 * bumps the marker to steer the requeue onto the RAID path,
> +	 * and pqi_process_raid_io_error() consumes the non-zero
> +	 * marker to offline a misbehaving drive.
> +	 */
> +	if (host_byte(scmd->result) != DID_IMM_RETRY)
> +		pqi_cmd_priv(scmd)->this_residual = 0;
> +

[Severity: High]
Does this code risk leaking the this_residual marker across unrelated
requests that reuse the same blk-mq tag?

If a command completing with DID_IMM_RETRY is terminally completed by the
SCSI midlayer instead of being requeued (for instance, if
scsi_cmd_runtime_exceeced(cmd) overrides the disposition to SUCCESS in
scsi_lib.c:scsi_complete()), the driver-private command data will not be
cleared here.

Because this patch disables the SCSI core's per-dispatch zeroing via
pqi_init_cmd_priv(), the stale this_residual > 0 marker would remain on
the tag.

If that poisoned tag is reused for a new request targeting a physical drive,
and the new request encounters a routine SCSI error (like ILLEGAL_REQUEST),
would pqi_process_raid_io_error() misinterpret the stale marker as a failed
AIO retry and erroneously call pqi_take_device_offline() on a healthy
physical drive?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260722202327.5242-3-david.strahan@microchip.com?part=1