Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f71ad62a authored by Michael Holzheu's avatar Michael Holzheu Committed by Martin Schwidefsky
Browse files

[S390] tape: Fix race condition in tape block device driver 



Due to incorrect function call sequence it can happen that a tape block
request is finished before the request is taken from the block request queue.

The following sequence leads to that condition:
 * tapeblock_start_request() -> start CCW program
 * Request finishes -> IO interrupt
 * tapeblock_end_request()
 * end_that_request_last()

If blkdev_dequeue_request() has not been called before end_that_request_last(),
a kernel bug is triggered in end_that_request_last() because the request is
still queued. To solve that problem blkdev_dequeue_request() has to be called
before starting the CCW program.

Signed-off-by: default avatarMichael Holzheu <holzheu@de.ibm.com>
Signed-off-by: default avatarMartin Schwidefsky <schwidefsky@de.ibm.com>
parent 97195d6b

drivers/s390/char/tape_block.c

+2 −2
Original line number Diff line number Diff line
@@ -179,11 +179,11 @@ tapeblock_requeue(struct work_struct *work) { 
			tapeblock_end_request(req, -EIO);

			continue;

		}

		blkdev_dequeue_request(req);

		nr_queued++;

		spin_unlock_irq(&device->blk_data.request_queue_lock);

		rc = tapeblock_start_request(device, req);

		spin_lock_irq(&device->blk_data.request_queue_lock);

		blkdev_dequeue_request(req);

		nr_queued++;

	}

	spin_unlock_irq(&device->blk_data.request_queue_lock);

	atomic_set(&device->blk_data.requeue_scheduled, 0);