bug in IBM ServeRAID driver?

bug in IBM ServeRAID driver?

[petter wahlman]

While looking through linux-2.4.18pre1/drivers/scsi/ips.c I noticed that
a spin_lock_irq is held while doing a possibly blocking operation.
Can't this code livelock on SMP if datasize is set?

linux-2.4.18pre1/drivers/scsi/ips.c

   1778       /* reobtain the lock */
   1779       spin_lock_irq(&io_request_lock);
   1780
   1781       /* command finished -- copy back */
   1782       user_area = *((char **) &SC->cmnd[4]);
   1783       kern_area = ha->ioctl_data;
   1784       datasize = *((u_int32_t *) &SC->cmnd[8]);
   1785
   1786       if (datasize) {
   1787          if (copy_to_user(user_area, kern_area, datasize) > 0) {
   1788             DEBUG_VAR(1, "(%s%d) passthru failed - unable to
copy out user data",
   1789                       ips_name, ha->host_num);


I am not subscribed to this list, so please CC me.


Petter Wahlman

Re: bug in IBM ServeRAID driver?

[Jens Axboe]

On Thu, Jan 03 2002, petter wahlman wrote:
> 
> While looking through linux-2.4.18pre1/drivers/scsi/ips.c I noticed that
> a spin_lock_irq is held while doing a possibly blocking operation.
> Can't this code livelock on SMP if datasize is set?
> 
> linux-2.4.18pre1/drivers/scsi/ips.c
> 
>    1778       /* reobtain the lock */
>    1779       spin_lock_irq(&io_request_lock);
>    1780
>    1781       /* command finished -- copy back */
>    1782       user_area = *((char **) &SC->cmnd[4]);
>    1783       kern_area = ha->ioctl_data;
>    1784       datasize = *((u_int32_t *) &SC->cmnd[8]);
>    1785
>    1786       if (datasize) {
>    1787          if (copy_to_user(user_area, kern_area, datasize) > 0) {
>    1788             DEBUG_VAR(1, "(%s%d) passthru failed - unable to
> copy out user data",
>    1789                       ips_name, ha->host_num);
> 
> 
> I am not subscribed to this list, so please CC me.

Yup, that's surely a nasty bug.

-- 
Jens Axboe

Re: bug in IBM ServeRAID driver?

[ServeRAID For Linux]

Sorry for the delayed response.   We have been snow-bound and shut-down
here for several days.   We will address this immediately.   Thanks for
bringing it to our attention.




                                                                                                 
                    Jens Axboe                                                                   
                    <axboe@suse.de       To:     petter wahlman <petter@bluezone.no>             
                    >                    cc:     linux-kernel@vger.kernel.org, ServeRAID For     
                                          Linux/Raleigh/IBM@IBMUS                                
                    01/03/2002           Subject:     Re: bug in IBM ServeRAID driver?           
                    03:06 PM                                                                     
                                                                                                 
                                                                                                 



On Thu, Jan 03 2002, petter wahlman wrote:
>
> While looking through linux-2.4.18pre1/drivers/scsi/ips.c I noticed that
> a spin_lock_irq is held while doing a possibly blocking operation.
> Can't this code livelock on SMP if datasize is set?
>
> linux-2.4.18pre1/drivers/scsi/ips.c
>
>    1778       /* reobtain the lock */
>    1779       spin_lock_irq(&io_request_lock);
>    1780
>    1781       /* command finished -- copy back */
>    1782       user_area = *((char **) &SC->cmnd[4]);
>    1783       kern_area = ha->ioctl_data;
>    1784       datasize = *((u_int32_t *) &SC->cmnd[8]);
>    1785
>    1786       if (datasize) {
>    1787          if (copy_to_user(user_area, kern_area, datasize) > 0) {
>    1788             DEBUG_VAR(1, "(%s%d) passthru failed - unable to
> copy out user data",
>    1789                       ips_name, ha->host_num);
>
>
> I am not subscribed to this list, so please CC me.

Yup, that's surely a nasty bug.

--
Jens Axboe