From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752237Ab2KIGg0 (ORCPT ); Fri, 9 Nov 2012 01:36:26 -0500 Received: from mail.linux-iscsi.org ([67.23.28.174]:36516 "EHLO linux-iscsi.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751321Ab2KIGgY (ORCPT ); Fri, 9 Nov 2012 01:36:24 -0500 From: "Nicholas A. Bellinger" To: target-devel Cc: linux-scsi , linux-kernel , Nicholas Bellinger , Paolo Bonzini , James Bottomley , Christoph Hellwig , stable@vger.kernel.org Subject: [PATCH] virtio-scsi: Fix incorrect lock release order in virtscsi_kick_cmd Date: Fri, 9 Nov 2012 06:29:52 +0000 Message-Id: <1352442592-2162-1-git-send-email-nab@linux-iscsi.org> X-Mailer: git-send-email 1.7.2.5 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Nicholas Bellinger This patch fixes a regression bug in virtscsi_kick_cmd() that relinquishes the acquired spinlocks in the incorrect order using the wrong spin_unlock macros, namely releasing vq->vq_lock before tgt->tgt_lock while invoking the calls to virtio_ring.c:virtqueue_add_buf() and friends. This bug was originally introduced in v3.5-rc7 code with: commit 2bd37f0fde99cbf8b78fb55f1128e8c3a63cf1da Author: Paolo Bonzini Date: Wed Jun 13 16:56:34 2012 +0200 [SCSI] virtio-scsi: split scatterlist per target Go ahead and make sure that vq->vq_lock is relinquished w/ spin_unlock first, then release tgt->tgt_lock w/ spin_unlock_irqrestore. Cc: Paolo Bonzini Cc: James Bottomley Cc: Christoph Hellwig Cc: stable@vger.kernel.org Signed-off-by: Nicholas Bellinger --- drivers/scsi/virtio_scsi.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c index 595af1a..b2abb8a 100644 --- a/drivers/scsi/virtio_scsi.c +++ b/drivers/scsi/virtio_scsi.c @@ -417,11 +417,11 @@ static int virtscsi_kick_cmd(struct virtio_scsi_target_state *tgt, spin_lock(&vq->vq_lock); ret = virtqueue_add_buf(vq->vq, tgt->sg, out_num, in_num, cmd, gfp); - spin_unlock(&tgt->tgt_lock); + spin_unlock(&vq->vq_lock); if (ret >= 0) ret = virtqueue_kick_prepare(vq->vq); - spin_unlock_irqrestore(&vq->vq_lock, flags); + spin_unlock_irqrestore(&tgt->tgt_lock, flags); if (ret > 0) virtqueue_notify(vq->vq); -- 1.7.2.5