From: Yaniv Gardi <ygardi@codeaurora.org>
To: robherring2@gmail.com, James.Bottomley@HansenPartnership.com,
pebolle@tiscali.nl, hch@infradead.org
Cc: linux-kernel@vger.kernel.org, linux-scsi@vger.kernel.org,
linux-arm-msm@vger.kernel.org, santoshsy@gmail.com,
linux-scsi-owner@vger.kernel.org, subhashj@codeaurora.org,
ygardi@codeaurora.org, gbroner@codeaurora.org,
draviv@codeaurora.org, Vinayak Holikatti <vinholikatti@gmail.com>,
"James E.J. Bottomley" <JBottomley@odin.com>
Subject: [PATCH v3 03/15] scsi: ufs: verify command tag validity
Date: Wed, 2 Sep 2015 13:13:03 +0300 [thread overview]
Message-ID: <1441188795-4600-4-git-send-email-ygardi@codeaurora.org> (raw)
In-Reply-To: <1441188795-4600-1-git-send-email-ygardi@codeaurora.org>
A race condition appear to exist between request completion when
scsi_done() is called to end the request and set the tag back to
-1 (at blk_queue_end_tag() scsi_end_request), and scsi layer error
handling which aborts the command and reuses it to request sense
data. Sending the request sense is done with tag which was set to -1
and so it is invalid.
Assert command tag passed from scsi layer is valid.
Signed-off-by: Gilad Broner <gbroner@codeaurora.org>
Signed-off-by: Yaniv Gardi <ygardi@codeaurora.org>
---
drivers/scsi/ufs/ufshcd.c | 24 ++++++++++++++++++++++--
1 file changed, 22 insertions(+), 2 deletions(-)
diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index 2d3ebca..8860a57 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -190,6 +190,10 @@ static int ufshcd_config_pwr_mode(struct ufs_hba *hba,
struct ufs_pa_layer_attr *desired_pwr_mode);
static int ufshcd_change_power_mode(struct ufs_hba *hba,
struct ufs_pa_layer_attr *pwr_mode);
+static inline bool ufshcd_valid_tag(struct ufs_hba *hba, int tag)
+{
+ return tag >= 0 && tag < hba->nutrs;
+}
static inline int ufshcd_enable_irq(struct ufs_hba *hba)
{
@@ -1310,6 +1314,12 @@ static int ufshcd_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *cmd)
hba = shost_priv(host);
tag = cmd->request->tag;
+ if (!ufshcd_valid_tag(hba, tag)) {
+ dev_err(hba->dev,
+ "%s: invalid command tag %d: cmd=0x%p, cmd->request=0x%p",
+ __func__, tag, cmd, cmd->request);
+ BUG();
+ }
spin_lock_irqsave(hba->host->host_lock, flags);
switch (hba->ufshcd_state) {
@@ -3862,13 +3872,23 @@ static int ufshcd_abort(struct scsi_cmnd *cmd)
host = cmd->device->host;
hba = shost_priv(host);
tag = cmd->request->tag;
+ if (!ufshcd_valid_tag(hba, tag)) {
+ dev_err(hba->dev,
+ "%s: invalid command tag %d: cmd=0x%p, cmd->request=0x%p",
+ __func__, tag, cmd, cmd->request);
+ BUG();
+ }
ufshcd_hold(hba, false);
+ reg = ufshcd_readl(hba, REG_UTP_TRANSFER_REQ_DOOR_BELL);
/* If command is already aborted/completed, return SUCCESS */
- if (!(test_bit(tag, &hba->outstanding_reqs)))
+ if (!(test_bit(tag, &hba->outstanding_reqs))) {
+ dev_err(hba->dev,
+ "%s: cmd at tag %d already completed, outstanding=0x%lx, doorbell=0x%x\n",
+ __func__, tag, hba->outstanding_reqs, reg);
goto out;
+ }
- reg = ufshcd_readl(hba, REG_UTP_TRANSFER_REQ_DOOR_BELL);
if (!(reg & (1 << tag))) {
dev_err(hba->dev,
"%s: cmd was completed, but without a notifying intr, tag = %d",
--
1.8.5.2
--
QUALCOMM ISRAEL, on behalf of Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum, hosted by The Linux Foundation
next prev parent reply other threads:[~2015-09-02 10:13 UTC|newest]
Thread overview: 35+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-09-02 10:13 [PATCH v3 00/15] Big fixes, retries, handle a race condition Yaniv Gardi
2015-09-02 10:13 ` [PATCH v3 01/15] scsi: ufs: clear UTRD, UPIU req and rsp before new transfers Yaniv Gardi
2015-09-02 10:13 ` [PATCH v3 02/15] scsi: ufs: clear fields " Yaniv Gardi
2015-10-22 7:14 ` subhashj
2015-09-02 10:13 ` Yaniv Gardi [this message]
2015-10-21 14:48 ` [PATCH v3 03/15] scsi: ufs: verify command tag validity Akinobu Mita
2015-10-25 13:29 ` ygardi
2015-10-22 7:17 ` subhashj
2015-09-02 10:13 ` [PATCH v3 04/15] scsi: ufs: clear outstanding_request bit in case query timeout Yaniv Gardi
2015-10-22 7:17 ` subhashj
2015-09-02 10:13 ` [PATCH v3 05/15] scsi: ufs: increase fDeviceInit query response timeout Yaniv Gardi
2015-10-23 11:18 ` Akinobu Mita
2015-10-25 13:38 ` ygardi
2015-10-26 12:59 ` Akinobu Mita
2015-09-02 10:13 ` [PATCH v3 06/15] scsi: ufs: avoid exception event handler racing with PM callbacks Yaniv Gardi
2015-09-02 10:13 ` [PATCH v3 07/15] scsi: ufs: set REQUEST_SENSE command size to 18 bytes Yaniv Gardi
2015-10-21 14:51 ` Akinobu Mita
2015-09-02 10:13 ` [PATCH v3 08/15] scsi: ufs: add retries to dme_peer get and set attribute Yaniv Gardi
2015-09-02 10:13 ` [PATCH v3 09/15] scsi: ufs: add retries for hibern8 enter Yaniv Gardi
2015-10-21 14:54 ` Akinobu Mita
2015-10-25 13:45 ` ygardi
2015-09-02 10:13 ` [PATCH v3 10/15] scsi: ufs: fix error recovery after the hibern8 exit failure Yaniv Gardi
2015-09-02 10:13 ` [PATCH v3 11/15] scsi: ufs: retry failed query flag requests Yaniv Gardi
2015-09-02 10:13 ` [PATCH v3 12/15] scsi: ufs: reduce the interrupts for power mode change requests Yaniv Gardi
2015-10-21 14:57 ` Akinobu Mita
2015-10-22 13:19 ` Akinobu Mita
2015-10-25 14:34 ` ygardi
2015-09-02 10:13 ` [PATCH v3 13/15] scsi: ufs: add missing memory barriers Yaniv Gardi
2015-10-22 13:21 ` Akinobu Mita
2015-10-25 14:40 ` ygardi
2015-10-26 12:23 ` Akinobu Mita
2015-10-26 12:35 ` ygardi
2015-10-27 10:21 ` ygardi
2015-09-02 10:13 ` [PATCH v3 14/15] scsi: ufs: commit descriptors before setting the doorbell Yaniv Gardi
2015-09-02 10:13 ` [PATCH v3 15/15] scsi: ufs: add wrapper for retrying sending query attribute Yaniv Gardi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1441188795-4600-4-git-send-email-ygardi@codeaurora.org \
--to=ygardi@codeaurora.org \
--cc=JBottomley@odin.com \
--cc=James.Bottomley@HansenPartnership.com \
--cc=draviv@codeaurora.org \
--cc=gbroner@codeaurora.org \
--cc=hch@infradead.org \
--cc=linux-arm-msm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-scsi-owner@vger.kernel.org \
--cc=linux-scsi@vger.kernel.org \
--cc=pebolle@tiscali.nl \
--cc=robherring2@gmail.com \
--cc=santoshsy@gmail.com \
--cc=subhashj@codeaurora.org \
--cc=vinholikatti@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).