[PATCH] 53c700: fix BUG on untagged commands

[PATCH] 53c700: fix BUG on untagged commands

[James Bottomley]

The untagged command case in the 53c700 driver has been broken since
host wide tags were enabled because the replaced scsi_find_tag()
function had a special case for the tag value SCSI_NO_TAG to retrieve
sdev->current_cmnd.  The replacement function scsi_host_find_tag() has
no such special case and returns NULL causing untagged commands to
trigger a BUG() in the driver.  Inspection shows that the 53c700 is the
only driver using this SCSI_NO_TAG case, so a local fix in the driver
suffices to fix this problem globally.

Fixes: 64d513ac31b - "scsi: use host wide tags by default"
Cc: stable@vger.kernel.org	# 4.4+
Reported-by: Helge Deller <deller@gmx.de>
Tested-by: Helge Deller <deller@gmx.de>
Signed-off-by: James Bottomley <jejb@linux.vnet.ibm.com>

---

diff --git a/drivers/scsi/53c700.c b/drivers/scsi/53c700.c
index d4c2856..3ddc85e 100644
--- a/drivers/scsi/53c700.c
+++ b/drivers/scsi/53c700.c
@@ -1122,7 +1122,7 @@ process_script_interrupt(__u32 dsps, __u32 dsp, struct scsi_cmnd *SCp,
 		} else {
 			struct scsi_cmnd *SCp;
 
-			SCp = scsi_host_find_tag(SDp->host, SCSI_NO_TAG);
+			SCp = SDp->current_cmnd;
 			if(unlikely(SCp == NULL)) {
 				sdev_printk(KERN_ERR, SDp,
 					"no saved request for untagged cmd\n");
@@ -1826,7 +1826,7 @@ NCR_700_queuecommand_lck(struct scsi_cmnd *SCp, void (*done)(struct scsi_cmnd *)
 		       slot->tag, slot);
 	} else {
 		slot->tag = SCSI_NO_TAG;
-		/* must populate current_cmnd for scsi_host_find_tag to work */
+		/* save current command for reselection */
 		SCp->device->current_cmnd = SCp;
 	}
 	/* sanity check: some of the commands generated by the mid-layer

Re: [PATCH] 53c700: fix BUG on untagged commands

[Johannes Thumshirn]

On Mon, Jun 13, 2016 at 10:00:07PM -0700, James Bottomley wrote:
> The untagged command case in the 53c700 driver has been broken since
> host wide tags were enabled because the replaced scsi_find_tag()
> function had a special case for the tag value SCSI_NO_TAG to retrieve
> sdev->current_cmnd.  The replacement function scsi_host_find_tag() ha=
s
> no such special case and returns NULL causing untagged commands to
> trigger a BUG() in the driver.  Inspection shows that the 53c700 is t=
he
> only driver using this SCSI_NO_TAG case, so a local fix in the driver
> suffices to fix this problem globally.
>=20
> Fixes: 64d513ac31b - "scsi: use host wide tags by default"
> Cc: stable@vger.kernel.org	# 4.4+
> Reported-by: Helge Deller <deller@gmx.de>
> Tested-by: Helge Deller <deller@gmx.de>
> Signed-off-by: James Bottomley <jejb@linux.vnet.ibm.com>

Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>

--=20
Johannes Thumshirn                                          Storage
jthumshirn@suse.de                                +49 911 74053 689
SUSE LINUX GmbH, Maxfeldstr. 5, 90409 N=FCrnberg
GF: Felix Imend=F6rffer, Jane Smithard, Graham Norton
HRB 21284 (AG N=FCrnberg)
Key fingerprint =3D EC38 9CAB C2C4 F25D 8600 D0D0 0393 969D 2D76 0850
--
To unsubscribe from this list: send the line "unsubscribe linux-parisc"=
 in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH] 53c700: fix BUG on untagged commands

[Johannes Thumshirn]

On Mon, Jun 13, 2016 at 10:00:07PM -0700, James Bottomley wrote:
> The untagged command case in the 53c700 driver has been broken since
> host wide tags were enabled because the replaced scsi_find_tag()
> function had a special case for the tag value SCSI_NO_TAG to retrieve
> sdev->current_cmnd.  The replacement function scsi_host_find_tag() has
> no such special case and returns NULL causing untagged commands to
> trigger a BUG() in the driver.  Inspection shows that the 53c700 is the
> only driver using this SCSI_NO_TAG case, so a local fix in the driver
> suffices to fix this problem globally.
> 
> Fixes: 64d513ac31b - "scsi: use host wide tags by default"
> Cc: stable@vger.kernel.org	# 4.4+
> Reported-by: Helge Deller <deller@gmx.de>
> Tested-by: Helge Deller <deller@gmx.de>
> Signed-off-by: James Bottomley <jejb@linux.vnet.ibm.com>

Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>

-- 
Johannes Thumshirn                                          Storage
jthumshirn@suse.de                                +49 911 74053 689
SUSE LINUX GmbH, Maxfeldstr. 5, 90409 Nürnberg
GF: Felix Imendörffer, Jane Smithard, Graham Norton
HRB 21284 (AG Nürnberg)
Key fingerprint = EC38 9CAB C2C4 F25D 8600 D0D0 0393 969D 2D76 0850
--
To unsubscribe from this list: send the line "unsubscribe linux-parisc" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH] 53c700: fix BUG on untagged commands

[Ewan D. Milne]

On Mon, 2016-06-13 at 22:00 -0700, James Bottomley wrote:
> The untagged command case in the 53c700 driver has been broken since
> host wide tags were enabled because the replaced scsi_find_tag()
> function had a special case for the tag value SCSI_NO_TAG to retrieve
> sdev->current_cmnd.  The replacement function scsi_host_find_tag() has
> no such special case and returns NULL causing untagged commands to
> trigger a BUG() in the driver.  Inspection shows that the 53c700 is the
> only driver using this SCSI_NO_TAG case, so a local fix in the driver
> suffices to fix this problem globally.
> 
> Fixes: 64d513ac31b - "scsi: use host wide tags by default"
> Cc: stable@vger.kernel.org	# 4.4+
> Reported-by: Helge Deller <deller@gmx.de>
> Tested-by: Helge Deller <deller@gmx.de>
> Signed-off-by: James Bottomley <jejb@linux.vnet.ibm.com>
> 
> ---
> 
> diff --git a/drivers/scsi/53c700.c b/drivers/scsi/53c700.c
> index d4c2856..3ddc85e 100644
> --- a/drivers/scsi/53c700.c
> +++ b/drivers/scsi/53c700.c
> @@ -1122,7 +1122,7 @@ process_script_interrupt(__u32 dsps, __u32 dsp, struct scsi_cmnd *SCp,
>  		} else {
>  			struct scsi_cmnd *SCp;
>  
> -			SCp = scsi_host_find_tag(SDp->host, SCSI_NO_TAG);
> +			SCp = SDp->current_cmnd;
>  			if(unlikely(SCp == NULL)) {
>  				sdev_printk(KERN_ERR, SDp,
>  					"no saved request for untagged cmd\n");
> @@ -1826,7 +1826,7 @@ NCR_700_queuecommand_lck(struct scsi_cmnd *SCp, void (*done)(struct scsi_cmnd *)
>  		       slot->tag, slot);
>  	} else {
>  		slot->tag = SCSI_NO_TAG;
> -		/* must populate current_cmnd for scsi_host_find_tag to work */
> +		/* save current command for reselection */
>  		SCp->device->current_cmnd = SCp;
>  	}
>  	/* sanity check: some of the commands generated by the mid-layer
> 
> 
> --
> To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reviewed-by: Ewan D. Milne <emilne@redhat.com>

Re: [PATCH] 53c700: fix BUG on untagged commands

[Christoph Hellwig]

Looks fine:

Acked-by: Christoph Hellwig <hch@lst.de>

But it should really go together with something like this:

---
>From e54d1462ae244db3189a8b69018bc5f3e3d3b468 Mon Sep 17 00:00:00 2001
From: Christoph Hellwig <hch@lst.de>
Date: Tue, 14 Jun 2016 17:04:10 +0200
Subject: scsi: move current_cmnd into the 53c700 driver

The 53c700 driver is the only user of the current_cmnd field in
struct scsi_device, so let's move it into the driver private data.

Signed-off-by: Christoph Hellwig <hch@lst.de>
---
 drivers/scsi/53c700.c      | 8 +++++---
 drivers/scsi/53c700.h      | 1 +
 include/scsi/scsi_device.h | 1 -
 3 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/scsi/53c700.c b/drivers/scsi/53c700.c
index 3ddc85e..de53b23 100644
--- a/drivers/scsi/53c700.c
+++ b/drivers/scsi/53c700.c
@@ -1120,9 +1120,9 @@ process_script_interrupt(__u32 dsps, __u32 dsp, struct scsi_cmnd *SCp,
 				"reselection is tag %d, slot %p(%d)\n",
 				hostdata->msgin[2], slot, slot->tag);
 		} else {
-			struct scsi_cmnd *SCp;
+			struct NCR_700_Device_Parameters *p = SDp->hostdata;
+			struct scsi_cmnd *SCp = p->current_cmnd;
 
-			SCp = SDp->current_cmnd;
 			if(unlikely(SCp == NULL)) {
 				sdev_printk(KERN_ERR, SDp,
 					"no saved request for untagged cmd\n");
@@ -1825,9 +1825,11 @@ NCR_700_queuecommand_lck(struct scsi_cmnd *SCp, void (*done)(struct scsi_cmnd *)
 		CDEBUG(KERN_DEBUG, SCp, "sending out tag %d, slot %p\n",
 		       slot->tag, slot);
 	} else {
+		struct NCR_700_Device_Parameters *p = SCp->device->hostdata;
+
 		slot->tag = SCSI_NO_TAG;
 		/* save current command for reselection */
-		SCp->device->current_cmnd = SCp;
+		p->current_cmnd = SCp;
 	}
 	/* sanity check: some of the commands generated by the mid-layer
 	 * have an eccentric idea of their sc_data_direction */
diff --git a/drivers/scsi/53c700.h b/drivers/scsi/53c700.h
index e06bdfe..83b157e 100644
--- a/drivers/scsi/53c700.h
+++ b/drivers/scsi/53c700.h
@@ -82,6 +82,7 @@ struct NCR_700_Device_Parameters {
 	 * cmnd[1], this could be in static storage */
 	unsigned char cmnd[MAX_COMMAND_SIZE];
 	__u8	depth;
+	struct scsi_cmnd *current_cmnd;	/* currently active command */
 };
 
 
diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h
index a6c346d..8a95631 100644
--- a/include/scsi/scsi_device.h
+++ b/include/scsi/scsi_device.h
@@ -94,7 +94,6 @@ struct scsi_device {
 	spinlock_t list_lock;
 	struct list_head cmd_list;	/* queue of in use SCSI Command structures */
 	struct list_head starved_entry;
-	struct scsi_cmnd *current_cmnd;	/* currently active command */
 	unsigned short queue_depth;	/* How deep of a queue we want */
 	unsigned short max_queue_depth;	/* max queue depth */
 	unsigned short last_queue_full_depth; /* These two are used by */
-- 
2.1.4

Re: [PATCH] 53c700: fix BUG on untagged commands

[Helge Deller]

On 14.06.2016 17:05, Christoph Hellwig wrote:
> Looks fine:
> 
> Acked-by: Christoph Hellwig <hch@lst.de>
> 
> But it should really go together with something like this:
> 
> ---
> From e54d1462ae244db3189a8b69018bc5f3e3d3b468 Mon Sep 17 00:00:00 2001
> From: Christoph Hellwig <hch@lst.de>
> Date: Tue, 14 Jun 2016 17:04:10 +0200
> Subject: scsi: move current_cmnd into the 53c700 driver
> 
> The 53c700 driver is the only user of the current_cmnd field in
> struct scsi_device, so let's move it into the driver private data.
> 
> Signed-off-by: Christoph Hellwig <hch@lst.de>

Patch is OK.

Tested-by: Helge Deller <deller@gmx.de>

Even if this is not a real fix, I still would suggest to add
Cc: stable@vger.kernel.org	# 4.4+
as well to get both patches backported at the same time.

Helge

> ---
>  drivers/scsi/53c700.c      | 8 +++++---
>  drivers/scsi/53c700.h      | 1 +
>  include/scsi/scsi_device.h | 1 -
>  3 files changed, 6 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/scsi/53c700.c b/drivers/scsi/53c700.c
> index 3ddc85e..de53b23 100644
> --- a/drivers/scsi/53c700.c
> +++ b/drivers/scsi/53c700.c
> @@ -1120,9 +1120,9 @@ process_script_interrupt(__u32 dsps, __u32 dsp, struct scsi_cmnd *SCp,
>  				"reselection is tag %d, slot %p(%d)\n",
>  				hostdata->msgin[2], slot, slot->tag);
>  		} else {
> -			struct scsi_cmnd *SCp;
> +			struct NCR_700_Device_Parameters *p = SDp->hostdata;
> +			struct scsi_cmnd *SCp = p->current_cmnd;
>  
> -			SCp = SDp->current_cmnd;
>  			if(unlikely(SCp == NULL)) {
>  				sdev_printk(KERN_ERR, SDp,
>  					"no saved request for untagged cmd\n");
> @@ -1825,9 +1825,11 @@ NCR_700_queuecommand_lck(struct scsi_cmnd *SCp, void (*done)(struct scsi_cmnd *)
>  		CDEBUG(KERN_DEBUG, SCp, "sending out tag %d, slot %p\n",
>  		       slot->tag, slot);
>  	} else {
> +		struct NCR_700_Device_Parameters *p = SCp->device->hostdata;
> +
>  		slot->tag = SCSI_NO_TAG;
>  		/* save current command for reselection */
> -		SCp->device->current_cmnd = SCp;
> +		p->current_cmnd = SCp;
>  	}
>  	/* sanity check: some of the commands generated by the mid-layer
>  	 * have an eccentric idea of their sc_data_direction */
> diff --git a/drivers/scsi/53c700.h b/drivers/scsi/53c700.h
> index e06bdfe..83b157e 100644
> --- a/drivers/scsi/53c700.h
> +++ b/drivers/scsi/53c700.h
> @@ -82,6 +82,7 @@ struct NCR_700_Device_Parameters {
>  	 * cmnd[1], this could be in static storage */
>  	unsigned char cmnd[MAX_COMMAND_SIZE];
>  	__u8	depth;
> +	struct scsi_cmnd *current_cmnd;	/* currently active command */
>  };
>  
>  
> diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h
> index a6c346d..8a95631 100644
> --- a/include/scsi/scsi_device.h
> +++ b/include/scsi/scsi_device.h
> @@ -94,7 +94,6 @@ struct scsi_device {
>  	spinlock_t list_lock;
>  	struct list_head cmd_list;	/* queue of in use SCSI Command structures */
>  	struct list_head starved_entry;
> -	struct scsi_cmnd *current_cmnd;	/* currently active command */
>  	unsigned short queue_depth;	/* How deep of a queue we want */
>  	unsigned short max_queue_depth;	/* max queue depth */
>  	unsigned short last_queue_full_depth; /* These two are used by */
> 

Re: [PATCH] 53c700: fix BUG on untagged commands

[Martin K. Petersen]

>>>>> "James" == James Bottomley <jejb@linux.vnet.ibm.com> writes:

James> The untagged command case in the 53c700 driver has been broken
James> since host wide tags were enabled because the replaced
James> scsi_find_tag() function had a special case for the tag value
James> SCSI_NO_TAG to retrieve sdev-> current_cmnd.  The replacement
James> function scsi_host_find_tag() has no such special case and
James> returns NULL causing untagged commands to trigger a BUG() in the
James> driver.  Inspection shows that the 53c700 is the only driver
James> using this SCSI_NO_TAG case, so a local fix in the driver
James> suffices to fix this problem globally.

Applied to 4.7/scsi-fixes.

-- 
Martin K. Petersen	Oracle Linux Engineering

Re: [PATCH] 53c700: fix BUG on untagged commands

[Martin K. Petersen]

>>>>> "Christoph" == Christoph Hellwig <hch@infradead.org> writes:

Christoph> But it should really go together with something like this:

I completely agree with your patch but it's more of a cleanup. I'll put
it in 4.8 once James' fix hits.

-- 
Martin K. Petersen	Oracle Linux Engineering

Re: [PATCH] 53c700: fix BUG on untagged commands

[James Bottomley]

On Tue, 2016-06-14 at 08:05 -0700, Christoph Hellwig wrote:
> Looks fine:
> 
> Acked-by: Christoph Hellwig <hch@lst.de>
> 
> But it should really go together with something like this:

Well, we need the simplest fix to backport, which is why I sent what I
did.

> ---
> From e54d1462ae244db3189a8b69018bc5f3e3d3b468 Mon Sep 17 00:00:00
> 2001
> From: Christoph Hellwig <hch@lst.de>
> Date: Tue, 14 Jun 2016 17:04:10 +0200
> Subject: scsi: move current_cmnd into the 53c700 driver
> 
> The 53c700 driver is the only user of the current_cmnd field in
> struct scsi_device, so let's move it into the driver private data.

The style in the driver is to use accessor functions for device
parameters, but I don't see it matters much since the day anyone would
write a new SPI driver (for which this was often the template) is long
gone.

James

Re: [PATCH] 53c700: fix BUG on untagged commands

[Hannes Reinecke]

On 06/14/2016 05:05 PM, Christoph Hellwig wrote:
> Looks fine:
>=20
> Acked-by: Christoph Hellwig <hch@lst.de>
>=20
> But it should really go together with something like this:
>=20
> ---
> From e54d1462ae244db3189a8b69018bc5f3e3d3b468 Mon Sep 17 00:00:00 200=
1
> From: Christoph Hellwig <hch@lst.de>
> Date: Tue, 14 Jun 2016 17:04:10 +0200
> Subject: scsi: move current_cmnd into the 53c700 driver
>=20
> The 53c700 driver is the only user of the current_cmnd field in
> struct scsi_device, so let's move it into the driver private data.
>=20
> Signed-off-by: Christoph Hellwig <hch@lst.de>
> ---
>  drivers/scsi/53c700.c      | 8 +++++---
>  drivers/scsi/53c700.h      | 1 +
>  include/scsi/scsi_device.h | 1 -
>  3 files changed, 6 insertions(+), 4 deletions(-)
>=20
Yes, please. I was wanting to get rid of the 'current_cmnd' thingie a
long time ago.

Reviewed-by: Hannes Reinecke <hare@suse.com>

Cheers,

Hannes
--=20
Dr. Hannes Reinecke		   Teamlead Storage & Networking
hare@suse.de			               +49 911 74053 688
SUSE LINUX GmbH, Maxfeldstr. 5, 90409 N=FCrnberg
GF: F. Imend=F6rffer, J. Smithard, J. Guild, D. Upmanyu, G. Norton
HRB 21284 (AG N=FCrnberg)
--
To unsubscribe from this list: send the line "unsubscribe linux-parisc"=
 in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH] 53c700: fix BUG on untagged commands

[Hannes Reinecke]

On 06/14/2016 05:05 PM, Christoph Hellwig wrote:
> Looks fine:
> 
> Acked-by: Christoph Hellwig <hch@lst.de>
> 
> But it should really go together with something like this:
> 
> ---
> From e54d1462ae244db3189a8b69018bc5f3e3d3b468 Mon Sep 17 00:00:00 2001
> From: Christoph Hellwig <hch@lst.de>
> Date: Tue, 14 Jun 2016 17:04:10 +0200
> Subject: scsi: move current_cmnd into the 53c700 driver
> 
> The 53c700 driver is the only user of the current_cmnd field in
> struct scsi_device, so let's move it into the driver private data.
> 
> Signed-off-by: Christoph Hellwig <hch@lst.de>
> ---
>  drivers/scsi/53c700.c      | 8 +++++---
>  drivers/scsi/53c700.h      | 1 +
>  include/scsi/scsi_device.h | 1 -
>  3 files changed, 6 insertions(+), 4 deletions(-)
> 
Yes, please. I was wanting to get rid of the 'current_cmnd' thingie a
long time ago.

Reviewed-by: Hannes Reinecke <hare@suse.com>

Cheers,

Hannes
-- 
Dr. Hannes Reinecke		   Teamlead Storage & Networking
hare@suse.de			               +49 911 74053 688
SUSE LINUX GmbH, Maxfeldstr. 5, 90409 Nürnberg
GF: F. Imendörffer, J. Smithard, J. Guild, D. Upmanyu, G. Norton
HRB 21284 (AG Nürnberg)
--
To unsubscribe from this list: send the line "unsubscribe linux-parisc" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html