Commit 03fe6a64 authored by Finn Thain's avatar Finn Thain Committed by Martin K. Petersen
Browse files

scsi: atari_scsi: Fix race condition between .queuecommand and EH 

It is possible that bus_reset_cleanup() or .eh_abort_handler could be
invoked during NCR5380_queuecommand(). If that takes place before the new
command is enqueued and after the ST-DMA "lock" has been acquired, the
ST-DMA "lock" will be released again. This will result in a lost DMA
interrupt and a command timeout. Fix this by excluding EH and interrupt
handlers while the new command is enqueued.

Link: https://lore.kernel.org/r/af25163257796b50bb99d4ede4025cea55787b8f.1605847196.git.fthain@telegraphics.com.au


Tested-by: default avatarMichael Schmitz <schmitzmic@gmail.com>
Reviewed-by: default avatarMichael Schmitz <schmitzmic@gmail.com>
Signed-off-by: default avatarFinn Thain <fthain@telegraphics.com.au>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent 66df79cc

drivers/scsi/NCR5380.c

+6 −3
Original line number Diff line number Diff line
@@ -580,11 +580,14 @@ static int NCR5380_queue_command(struct Scsi_Host *instance, 


	cmd->result = 0;



	if (!NCR5380_acquire_dma_irq(instance))

		return SCSI_MLQUEUE_HOST_BUSY;



	spin_lock_irqsave(&hostdata->lock, flags);



	if (!NCR5380_acquire_dma_irq(instance)) {

		spin_unlock_irqrestore(&hostdata->lock, flags);



		return SCSI_MLQUEUE_HOST_BUSY;

	}



	/*

	 * Insert the cmd into the issue queue. Note that REQUEST SENSE

	 * commands are added to the head of the queue since any command will

drivers/scsi/atari_scsi.c

+3 −7
Original line number Diff line number Diff line
@@ -376,15 +376,11 @@ static int falcon_get_lock(struct Scsi_Host *instance) 
	if (IS_A_TT())

		return 1;



	if (stdma_is_locked_by(scsi_falcon_intr) &&

	    instance->hostt->can_queue > 1)

	if (stdma_is_locked_by(scsi_falcon_intr))

		return 1;



	if (in_interrupt())

	/* stdma_lock() may sleep which means it can't be used here */

	return stdma_try_lock(scsi_falcon_intr, instance);



	stdma_lock(scsi_falcon_intr, instance);

	return 1;

}



#ifndef MODULE