[PATCH 15/21] scsi: mpi3mr: Fix block_io accounting when a target is re-created during BSG

[Ranjan Kumar <ranjan.kumar@broadcom.com>]

A BSG task management request raises block_io on the SCSI target private
data when it starts and lowers it when it completes. If the target is
removed and created again while the command waits, the new private data
can be allocated at the address of the old one. The address check then
passes and the command lowers block_io of the new target, which may be
held by another path.

Give each private data a sequence number and lower block_io only when the
number is the same as when the command started.

Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com>
---
 drivers/scsi/mpi3mr/mpi3mr.h     |  8 +++----
 drivers/scsi/mpi3mr/mpi3mr_app.c |  8 +++----
 drivers/scsi/mpi3mr/mpi3mr_os.c  | 40 ++++++++++++++++++++------------
 3 files changed, 33 insertions(+), 23 deletions(-)

diff --git a/drivers/scsi/mpi3mr/mpi3mr.h b/drivers/scsi/mpi3mr/mpi3mr.h
index da47100d895e..8738fc2ce7e7 100644
--- a/drivers/scsi/mpi3mr/mpi3mr.h
+++ b/drivers/scsi/mpi3mr/mpi3mr.h
@@ -847,6 +847,7 @@ struct mpi3mr_stgt_priv_data {
 	u16 perst_id;
 	u32 num_luns;
 	atomic_t block_io;
+	u64 seq;
 	u8 dev_removed;
 	u8 dev_removedelay;
 	u8 dev_type;
@@ -1533,11 +1534,10 @@ int mpi3mr_issue_tm(struct mpi3mr_ioc *mrioc, u8 tm_type,
 	u16 handle, uint lun, u16 htag, ulong timeout,
 	struct mpi3mr_drv_cmd *drv_cmd,
 	u8 *resp_code, struct scsi_cmnd *scmd);
-struct mpi3mr_stgt_priv_data *mpi3mr_tgtdev_block_io_inc(struct mpi3mr_ioc *mrioc,
-							 struct mpi3mr_tgt_dev *tgtdev);
+u64 mpi3mr_tgtdev_block_io_inc(struct mpi3mr_ioc *mrioc,
+			       struct mpi3mr_tgt_dev *tgtdev);
 void mpi3mr_tgtdev_block_io_dec(struct mpi3mr_ioc *mrioc,
-				struct mpi3mr_tgt_dev *tgtdev,
-				struct mpi3mr_stgt_priv_data *stgt_priv);
+				struct mpi3mr_tgt_dev *tgtdev, u64 seq);
 struct mpi3mr_tgt_dev *mpi3mr_get_tgtdev_by_handle(
 	struct mpi3mr_ioc *mrioc, u16 handle);
 void mpi3mr_pel_get_seqnum_complete(struct mpi3mr_ioc *mrioc,
diff --git a/drivers/scsi/mpi3mr/mpi3mr_app.c b/drivers/scsi/mpi3mr/mpi3mr_app.c
index 4df0dc81358b..30a01b02a9fc 100644
--- a/drivers/scsi/mpi3mr/mpi3mr_app.c
+++ b/drivers/scsi/mpi3mr/mpi3mr_app.c
@@ -2440,7 +2440,7 @@ static long mpi3mr_bsg_process_mpt_cmds(struct bsg_job *job)
 	u32 erbsz = MPI3MR_SENSE_BUF_SZ, tmplen;
 	u16 dev_handle;
 	struct mpi3mr_tgt_dev *tgtdev = NULL;
-	struct mpi3mr_stgt_priv_data *stgt_priv = NULL;
+	u64 block_seq = 0;
 	struct mpi3mr_bsg_in_reply_buf *bsg_reply_buf = NULL;
 	u32 din_size = 0, dout_size = 0;
 	u8 *din_buf = NULL, *dout_buf = NULL;
@@ -2792,7 +2792,7 @@ static long mpi3mr_bsg_process_mpt_cmds(struct bsg_job *job)
 	if (block_io) {
 		tgtdev = mpi3mr_get_tgtdev_by_handle(mrioc, dev_handle);
 		if (tgtdev)
-			stgt_priv = mpi3mr_tgtdev_block_io_inc(mrioc, tgtdev);
+			block_seq = mpi3mr_tgtdev_block_io_inc(mrioc, tgtdev);
 	}
 
 	mrioc->bsg_cmds.state = MPI3MR_CMD_PENDING;
@@ -2825,7 +2825,7 @@ static long mpi3mr_bsg_process_mpt_cmds(struct bsg_job *job)
 		    "%s: posting bsg request is failed\n", __func__);
 		rval = -EAGAIN;
 		if (tgtdev) {
-			mpi3mr_tgtdev_block_io_dec(mrioc, tgtdev, stgt_priv);
+			mpi3mr_tgtdev_block_io_dec(mrioc, tgtdev, block_seq);
 			mpi3mr_tgtdev_put(tgtdev);
 		}
 		goto out_unlock;
@@ -2833,7 +2833,7 @@ static long mpi3mr_bsg_process_mpt_cmds(struct bsg_job *job)
 	wait_for_completion_timeout(&mrioc->bsg_cmds.done,
 	    (karg->timeout * HZ));
 	if (tgtdev) {
-		mpi3mr_tgtdev_block_io_dec(mrioc, tgtdev, stgt_priv);
+		mpi3mr_tgtdev_block_io_dec(mrioc, tgtdev, block_seq);
 		mpi3mr_tgtdev_put(tgtdev);
 	}
 	if (!(mrioc->bsg_cmds.state & MPI3MR_CMD_COMPLETE)) {
diff --git a/drivers/scsi/mpi3mr/mpi3mr_os.c b/drivers/scsi/mpi3mr/mpi3mr_os.c
index e7833b24c509..67d41e4a0a0a 100644
--- a/drivers/scsi/mpi3mr/mpi3mr_os.c
+++ b/drivers/scsi/mpi3mr/mpi3mr_os.c
@@ -788,6 +788,8 @@ struct mpi3mr_tgt_dev *mpi3mr_get_tgtdev_by_handle(
 	return tgtdev;
 }
 
+static atomic64_t mpi3mr_stgt_seq = ATOMIC64_INIT(0);
+
 /**
  * mpi3mr_tgtdev_block_io_inc - Block I/O on the SCSI target of a tgtdev
  * @mrioc: Adapter instance reference
@@ -797,46 +799,52 @@ struct mpi3mr_tgt_dev *mpi3mr_get_tgtdev_by_handle(
  * increment are done under tgtdev_lock, which mpi3mr_target_destroy holds
  * while it frees the private data.
  *
- * Return: The private data that was incremented, only to be handed back to
- * mpi3mr_tgtdev_block_io_dec. NULL if the tgtdev has no SCSI target.
+ * Return: Sequence number of the private data that was incremented, to be
+ * handed back to mpi3mr_tgtdev_block_io_dec. 0 if the tgtdev has no SCSI
+ * target.
  */
-struct mpi3mr_stgt_priv_data *mpi3mr_tgtdev_block_io_inc(struct mpi3mr_ioc *mrioc,
-							 struct mpi3mr_tgt_dev *tgtdev)
+u64 mpi3mr_tgtdev_block_io_inc(struct mpi3mr_ioc *mrioc,
+			       struct mpi3mr_tgt_dev *tgtdev)
 {
-	struct mpi3mr_stgt_priv_data *stgt_priv = NULL;
+	struct mpi3mr_stgt_priv_data *stgt_priv;
 	unsigned long flags;
+	u64 seq = 0;
 
 	spin_lock_irqsave(&mrioc->tgtdev_lock, flags);
 	if (tgtdev->starget && tgtdev->starget->hostdata) {
 		stgt_priv = tgtdev->starget->hostdata;
 		atomic_inc(&stgt_priv->block_io);
+		seq = stgt_priv->seq;
 	}
 	spin_unlock_irqrestore(&mrioc->tgtdev_lock, flags);
-	return stgt_priv;
+	return seq;
 }
 
 /**
  * mpi3mr_tgtdev_block_io_dec - Undo mpi3mr_tgtdev_block_io_inc
  * @mrioc: Adapter instance reference
  * @tgtdev: Target device reference, held by the caller
- * @stgt_priv: Value returned by mpi3mr_tgtdev_block_io_inc
+ * @seq: Value returned by mpi3mr_tgtdev_block_io_inc
  *
- * Decrement block_io only if the SCSI target still has the same private
- * data. If the target was removed meanwhile the private data is gone
- * and there is nothing to undo.
+ * Decrement block_io only if the SCSI target still has the private data
+ * that was incremented. A private data allocated later at the same address
+ * has a different sequence number and is left alone.
  */
 void mpi3mr_tgtdev_block_io_dec(struct mpi3mr_ioc *mrioc,
-				struct mpi3mr_tgt_dev *tgtdev,
-				struct mpi3mr_stgt_priv_data *stgt_priv)
+				struct mpi3mr_tgt_dev *tgtdev, u64 seq)
 {
+	struct mpi3mr_stgt_priv_data *stgt_priv;
 	unsigned long flags;
 
-	if (!stgt_priv)
+	if (!seq)
 		return;
 
 	spin_lock_irqsave(&mrioc->tgtdev_lock, flags);
-	if (tgtdev->starget && tgtdev->starget->hostdata == stgt_priv)
-		atomic_dec_if_positive(&stgt_priv->block_io);
+	if (tgtdev->starget && tgtdev->starget->hostdata) {
+		stgt_priv = tgtdev->starget->hostdata;
+		if (stgt_priv->seq == seq)
+			atomic_dec_if_positive(&stgt_priv->block_io);
+	}
 	spin_unlock_irqrestore(&mrioc->tgtdev_lock, flags);
 }
 
@@ -5139,6 +5147,8 @@ static int mpi3mr_target_alloc(struct scsi_target *starget)
 	if (!scsi_tgt_priv_data)
 		return -ENOMEM;
 
+	scsi_tgt_priv_data->seq = atomic64_inc_return(&mpi3mr_stgt_seq);
+
 	starget->hostdata = scsi_tgt_priv_data;
 
 	spin_lock_irqsave(&mrioc->tgtdev_lock, flags);
-- 
2.47.3