[PATCH] scsi: scsi_debug: Fix sdebug_blk_mq_poll() in_use_bm bitmap use

[PATCH] scsi: scsi_debug: Fix sdebug_blk_mq_poll() in_use_bm bitmap use

[Damien Le Moal]

The in_use_bm bitmap of struct sdebug_queue should be accessed under
protection of the qc_lock spinlock. Make sure that this lock is taken
before calling find_first_bit() at the beginning of the function
sdebug_blk_mq_poll().

Fixes: 3fd07aecb750 ("scsi: scsi_debug: Fix qc_lock use in sdebug_blk_mq_poll()")
Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
---
 drivers/scsi/scsi_debug.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
index c607755cce00..ff78ef702f22 100644
--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -7519,12 +7519,13 @@ static int sdebug_blk_mq_poll(struct Scsi_Host *shost, unsigned int queue_num)
 	struct sdebug_defer *sd_dp;
 
 	sqp = sdebug_q_arr + queue_num;
-	qc_idx = find_first_bit(sqp->in_use_bm, sdebug_max_queue);
-	if (qc_idx >= sdebug_max_queue)
-		return 0;
 
 	spin_lock_irqsave(&sqp->qc_lock, iflags);
 
+	qc_idx = find_first_bit(sqp->in_use_bm, sdebug_max_queue);
+	if (qc_idx >= sdebug_max_queue)
+		goto unlock;
+
 	for (first = true; first || qc_idx + 1 < sdebug_max_queue; )   {
 		if (first) {
 			first = false;
@@ -7589,6 +7590,7 @@ static int sdebug_blk_mq_poll(struct Scsi_Host *shost, unsigned int queue_num)
 			break;
 	}
 
+unlock:
 	spin_unlock_irqrestore(&sqp->qc_lock, iflags);
 
 	if (num_entries > 0)
-- 
2.35.1

Re: [PATCH] scsi: scsi_debug: Fix sdebug_blk_mq_poll() in_use_bm bitmap use

[Douglas Gilbert]

On 2022-04-04 00:55, Damien Le Moal wrote:
> The in_use_bm bitmap of struct sdebug_queue should be accessed under
> protection of the qc_lock spinlock. Make sure that this lock is taken
> before calling find_first_bit() at the beginning of the function
> sdebug_blk_mq_poll().
> 
> Fixes: 3fd07aecb750 ("scsi: scsi_debug: Fix qc_lock use in sdebug_blk_mq_poll()")
> Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>

Acked-by: Douglas Gilbert <dgilbert@interlog.com>

> ---
>   drivers/scsi/scsi_debug.c | 8 +++++---
>   1 file changed, 5 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
> index c607755cce00..ff78ef702f22 100644
> --- a/drivers/scsi/scsi_debug.c
> +++ b/drivers/scsi/scsi_debug.c
> @@ -7519,12 +7519,13 @@ static int sdebug_blk_mq_poll(struct Scsi_Host *shost, unsigned int queue_num)
>   	struct sdebug_defer *sd_dp;
>   
>   	sqp = sdebug_q_arr + queue_num;
> -	qc_idx = find_first_bit(sqp->in_use_bm, sdebug_max_queue);
> -	if (qc_idx >= sdebug_max_queue)
> -		return 0;
>   
>   	spin_lock_irqsave(&sqp->qc_lock, iflags);
>   
> +	qc_idx = find_first_bit(sqp->in_use_bm, sdebug_max_queue);
> +	if (qc_idx >= sdebug_max_queue)
> +		goto unlock;
> +
>   	for (first = true; first || qc_idx + 1 < sdebug_max_queue; )   {
>   		if (first) {
>   			first = false;
> @@ -7589,6 +7590,7 @@ static int sdebug_blk_mq_poll(struct Scsi_Host *shost, unsigned int queue_num)
>   			break;
>   	}
>   
> +unlock:
>   	spin_unlock_irqrestore(&sqp->qc_lock, iflags);
>   
>   	if (num_entries > 0)

Re: [PATCH] scsi: scsi_debug: Fix sdebug_blk_mq_poll() in_use_bm bitmap use

[Martin K. Petersen]

Damien,

> The in_use_bm bitmap of struct sdebug_queue should be accessed under
> protection of the qc_lock spinlock. Make sure that this lock is taken
> before calling find_first_bit() at the beginning of the function
> sdebug_blk_mq_poll().

Applied to 5.18/scsi-fixes, thanks!

-- 
Martin K. Petersen	Oracle Linux Engineering