IB/srp: Fix race conditions related to task management (a2898ad0) · Commits · e / devices / android_kernel_fairphone_FP3

drivers/infiniband/ulp/srp/ib_srp.c

+29 −16

Original line number	Diff line number	Diff line
		@@ -1872,12 +1872,17 @@ static void srp_process_rsp(struct srp_rdma_ch ch, struct srp_rsp rsp)
		if (unlikely(rsp->tag & SRP_TAG_TSK_MGMT)) {
		spin_lock_irqsave(&ch->lock, flags);
		ch->req_lim += be32_to_cpu(rsp->req_lim_delta);
		spin_unlock_irqrestore(&ch->lock, flags);

		if (rsp->tag == ch->tsk_mgmt_tag) {
		ch->tsk_mgmt_status = -1;
		if (be32_to_cpu(rsp->resp_data_len) >= 4)
		ch->tsk_mgmt_status = rsp->data[3];
		complete(&ch->tsk_mgmt_done);
		} else {
		shost_printk(KERN_ERR, target->scsi_host,
		"Received tsk mgmt response too late for tag %#llx\n",
		rsp->tag);
		}
		spin_unlock_irqrestore(&ch->lock, flags);
		} else {
		scmnd = scsi_host_find_tag(target->scsi_host, rsp->tag);
		if (scmnd && scmnd->host_scribble) {
		@@ -2516,19 +2521,18 @@ srp_change_queue_depth(struct scsi_device *sdev, int qdepth)
		}

		static int srp_send_tsk_mgmt(struct srp_rdma_ch *ch, u64 req_tag, u64 lun,
		u8 func)
		u8 func, u8 *status)
		{
		struct srp_target_port *target = ch->target;
		struct srp_rport *rport = target->rport;
		struct ib_device *dev = target->srp_host->srp_dev->dev;
		struct srp_iu *iu;
		struct srp_tsk_mgmt *tsk_mgmt;
		int res;

		if (!ch->connected \|\| target->qp_in_error)
		return -1;

		init_completion(&ch->tsk_mgmt_done);

		/*
		* Lock the rport mutex to avoid that srp_create_ch_ib() is
		* invoked while a task management function is being sent.
		@@ -2551,10 +2555,16 @@ static int srp_send_tsk_mgmt(struct srp_rdma_ch *ch, u64 req_tag, u64 lun,

		tsk_mgmt->opcode = SRP_TSK_MGMT;
		int_to_scsilun(lun, &tsk_mgmt->lun);
		tsk_mgmt->tag = req_tag \| SRP_TAG_TSK_MGMT;
		tsk_mgmt->tsk_mgmt_func = func;
		tsk_mgmt->task_tag = req_tag;

		spin_lock_irq(&ch->lock);
		ch->tsk_mgmt_tag = (ch->tsk_mgmt_tag + 1) \| SRP_TAG_TSK_MGMT;
		tsk_mgmt->tag = ch->tsk_mgmt_tag;
		spin_unlock_irq(&ch->lock);

		init_completion(&ch->tsk_mgmt_done);

		ib_dma_sync_single_for_device(dev, iu->dma, sizeof *tsk_mgmt,
		DMA_TO_DEVICE);
		if (srp_post_send(ch, iu, sizeof(*tsk_mgmt))) {
		@@ -2563,13 +2573,15 @@ static int srp_send_tsk_mgmt(struct srp_rdma_ch *ch, u64 req_tag, u64 lun,

		return -1;
		}
		res = wait_for_completion_timeout(&ch->tsk_mgmt_done,
		msecs_to_jiffies(SRP_ABORT_TIMEOUT_MS));
		if (res > 0 && status)
		*status = ch->tsk_mgmt_status;
		mutex_unlock(&rport->mutex);

		if (!wait_for_completion_timeout(&ch->tsk_mgmt_done,
		msecs_to_jiffies(SRP_ABORT_TIMEOUT_MS)))
		return -1;
		WARN_ON_ONCE(res < 0);

		return 0;
		return res > 0 ? 0 : -1;
		}

		static int srp_abort(struct scsi_cmnd *scmnd)
		@@ -2595,7 +2607,7 @@ static int srp_abort(struct scsi_cmnd *scmnd)
		shost_printk(KERN_ERR, target->scsi_host,
		"Sending SRP abort for tag %#x\n", tag);
		if (srp_send_tsk_mgmt(ch, tag, scmnd->device->lun,
		SRP_TSK_ABORT_TASK) == 0)
		SRP_TSK_ABORT_TASK, NULL) == 0)
		ret = SUCCESS;
		else if (target->rport->state == SRP_RPORT_LOST)
		ret = FAST_IO_FAIL;
		@@ -2613,14 +2625,15 @@ static int srp_reset_device(struct scsi_cmnd *scmnd)
		struct srp_target_port *target = host_to_target(scmnd->device->host);
		struct srp_rdma_ch *ch;
		int i;
		u8 status;

		shost_printk(KERN_ERR, target->scsi_host, "SRP reset_device called\n");

		ch = &target->ch[0];
		if (srp_send_tsk_mgmt(ch, SRP_TAG_NO_REQ, scmnd->device->lun,
		SRP_TSK_LUN_RESET))
		SRP_TSK_LUN_RESET, &status))
		return FAILED;
		if (ch->tsk_mgmt_status)
		if (status)
		return FAILED;

		for (i = 0; i < target->ch_count; i++) {

drivers/infiniband/ulp/srp/ib_srp.h

+1 −0

Original line number	Diff line number	Diff line
		@@ -163,6 +163,7 @@ struct srp_rdma_ch {
		int max_ti_iu_len;
		int comp_vector;

		u64 tsk_mgmt_tag;
		struct completion tsk_mgmt_done;
		u8 tsk_mgmt_status;
		bool connected;