Patch "scsi: sg: reset 'res_in_use' after unlinking reserved array" has been added to the 4.4-stable tree

Patch "scsi: sg: reset 'res_in_use' after unlinking reserved array" has been added to the 4.4-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    scsi: sg: reset 'res_in_use' after unlinking reserved array

to the 4.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     scsi-sg-reset-res_in_use-after-unlinking-reserved-array.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From e791ce27c3f6a1d3c746fd6a8f8e36c9540ec6f9 Mon Sep 17 00:00:00 2001
From: Hannes Reinecke <hare@suse.de>
Date: Mon, 24 Apr 2017 10:26:36 +0200
Subject: scsi: sg: reset 'res_in_use' after unlinking reserved array

From: Hannes Reinecke <hare@suse.de>

commit e791ce27c3f6a1d3c746fd6a8f8e36c9540ec6f9 upstream.

Once the reserved page array is unused we can reset the 'res_in_use'
state; here we can do a lazy update without holding the mutex as we only
need to check against concurrent access, not concurrent release.

[mkp: checkpatch]

Fixes: 1bc0eb044615 ("scsi: sg: protect accesses to 'reserved' page array")
Signed-off-by: Hannes Reinecke <hare@suse.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Cc: Todd Poynor <toddpoynor@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/scsi/sg.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -2052,6 +2052,8 @@ sg_unlink_reserve(Sg_fd * sfp, Sg_reques
 	req_schp->sglist_len = 0;
 	sfp->save_scat_len = 0;
 	srp->res_used = 0;
+	/* Called without mutex lock to avoid deadlock */
+	sfp->res_in_use = 0;
 }
 
 static Sg_request *


Patches currently in stable-queue which might be from hare@suse.de are

queue-4.4/scsi-sg-protect-accesses-to-reserved-page-array.patch
queue-4.4/scsi-sg-reset-res_in_use-after-unlinking-reserved-array.patch

Re: Patch "scsi: sg: reset 'res_in_use' after unlinking reserved array" has been added to the 4.4-stable tree

[Ben Hutchings]

On Thu, 2017-08-31 at 08:20 +0200, gregkh@linuxfoundation.org wrote:
[...]
> 
> Subject: scsi: sg: reset 'res_in_use' after unlinking reserved array
> 
> From: Hannes Reinecke <hare@suse.de>
> 
> commit e791ce27c3f6a1d3c746fd6a8f8e36c9540ec6f9 upstream.
> 
> Once the reserved page array is unused we can reset the 'res_in_use'
> state; here we can do a lazy update without holding the mutex as we only
> need to check against concurrent access, not concurrent release.
[...]

This description makes no sense.  A simple write to a variable cannot
be used to synchronise anything as it can be reordered with other
memory operations, including those that write to the buffer you're
trying to protect.  This write needs to be combined with a release
barrier or preceded by an smp_wmb().  Every read of res_in_use needs to
be combined with an acquire barrier or followed by an smp_rmb().

Ben.

> --- a/drivers/scsi/sg.c
> +++ b/drivers/scsi/sg.c
> @@ -2052,6 +2052,8 @@ sg_unlink_reserve(Sg_fd * sfp, Sg_reques
>  	req_schp->sglist_len = 0;
>  	sfp->save_scat_len = 0;
>  	srp->res_used = 0;
> +	/* Called without mutex lock to avoid deadlock */
> +	sfp->res_in_use = 0;
>  }
>  
>  static Sg_request *

-- 
Ben Hutchings
Software Developer, Codethink Ltd.