Re: [PATCH] ata: libata-sff: fix race between IRQ deferral and ata_sff_flush_pio_task()

[Damien Le Moal <dlemoal@kernel.org>]

On 2026/10/20 12:11, Niklas Cassel wrote:
> Commit 4a2e5409472e ("ata: libata-sff: don't busy-wait for PIO data-in
> command completion") allowed the interrupt handler to queue
> ap->sff_pio_task from ata_sff_hsm_move() when a PIO data-in command is
> still busy after its final data block.
> 
> ata_sff_flush_pio_task(), however, was written under the assumption that
> cancel_delayed_work_sync() is enough to prevent sff_pio_task from being
> queued again before the HSM state is reset to HSM_ST_IDLE and
> sff_pio_task_link is cleared.
> 
> The flush runs early during error handling, at a point where the timed
> out command is still active, the port is not frozen yet, and interrupts
> are still being serviced.  If the final data-block interrupt of a PIO
> data-in command is serviced in the window between
> cancel_delayed_work_sync() and the reset of hsm_task_state, the
> interrupt handler queues sff_pio_task after the cancel has completed.
> When that work item then executes on ata_sff_wq after the flush cleared
> ap->sff_pio_task_link, ata_sff_pio_task() hits
> BUG_ON(ap->sff_pio_task_link == NULL) while holding the host lock with
> interrupts disabled; alternatively it proceeds on a stale link while
> error handling owns the port.
> 
> Fix this by resetting hsm_task_state to HSM_ST_IDLE before cancelling
> the work item.  Once the state is IDLE, __ata_sff_port_intr() can no
> longer enter ata_sff_hsm_move(), so the interrupt handler can no longer
> queue the pio task, and cancel_delayed_work_sync() drains whatever was
> queued before the reset.
> 
> Also make ata_sff_pio_task() bail out quietly when the HSM state was
> marked idle by the flush, both at entry and after re-acquiring the port
> lock following ata_msleep(), since a work item can already be running
> when the flush resets the state.
> 
> Reported-by: sashiko-bot <sashiko-bot@kernel.org>
> Link: https://lore.kernel.org/linux-ide/sashiko-outbox-177477@kernel.org/
> Fixes: 4a2e5409472e ("ata: libata-sff: don't busy-wait for PIO data-in command completion")
> Cc: stable@vger.kernel.org
> Signed-off-by: Niklas Cassel <cassel@kernel.org>

Looks good.

Reviewed-by: Damien Le Moal <dlemoal@kernel.org>

-- 
Damien Le Moal
Western Digital Research