Commit 26fc0ea7 authored by John Garry's avatar John Garry Committed by Martin K. Petersen
Browse files

scsi: libsas: Drop SAS_TASK_AT_INITIATOR 

This flag is now only ever set, so delete it.

This also avoids a use-after-free in the pm8001 queue path, as reported in
the following:

https://lore.kernel.org/linux-scsi/c3cb7228-254e-9584-182b-007ac5e6fe0a@huawei.com/T/#m28c94c6d3ff582ec4a9fa54819180740e8bd4cfb

https://lore.kernel.org/linux-scsi/0cc0c435-b4f2-9c76-258d-865ba50a29dd@huawei.com/

[mkp: checkpatch + two SAS_TASK_AT_INITIATOR references]

Link: https://lore.kernel.org/r/1644489804-85730-3-git-send-email-john.garry@huawei.com


Reviewed-by: default avatarDamien Le Moal <damien.lemoal@wdc.com>
Signed-off-by: default avatarJohn Garry <john.garry@huawei.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent c39d5aa4

drivers/scsi/aic94xx/aic94xx_task.c

+0 −9
Original line number Diff line number Diff line
@@ -322,7 +322,6 @@ static void asd_task_tasklet_complete(struct asd_ascb *ascb, 


	spin_lock_irqsave(&task->task_state_lock, flags);

	task->task_state_flags &= ~SAS_TASK_STATE_PENDING;

	task->task_state_flags &= ~SAS_TASK_AT_INITIATOR;

	task->task_state_flags |= SAS_TASK_STATE_DONE;

	if (unlikely((task->task_state_flags & SAS_TASK_STATE_ABORTED))) {

		struct completion *completion = ascb->completion;
@@ -532,7 +531,6 @@ int asd_execute_task(struct sas_task *task, gfp_t gfp_flags) 
	struct sas_task *t = task;

	struct asd_ascb *ascb = NULL, *a;

	struct asd_ha_struct *asd_ha = task->dev->port->ha->lldd_ha;

	unsigned long flags;



	res = asd_can_queue(asd_ha, 1);

	if (res)
@@ -575,10 +573,6 @@ int asd_execute_task(struct sas_task *task, gfp_t gfp_flags) 
		}

		if (res)

			goto out_err_unmap;



		spin_lock_irqsave(&t->task_state_lock, flags);

		t->task_state_flags |= SAS_TASK_AT_INITIATOR;

		spin_unlock_irqrestore(&t->task_state_lock, flags);

	}

	list_del_init(&alist);
@@ -597,9 +591,6 @@ int asd_execute_task(struct sas_task *task, gfp_t gfp_flags) 
			if (a == b)

				break;

			t = a->uldd_task;

			spin_lock_irqsave(&t->task_state_lock, flags);

			t->task_state_flags &= ~SAS_TASK_AT_INITIATOR;

			spin_unlock_irqrestore(&t->task_state_lock, flags);

			switch (t->task_proto) {

			case SAS_PROTOCOL_SATA:

			case SAS_PROTOCOL_STP:

drivers/scsi/hisi_sas/hisi_sas_main.c

+1 −7
Original line number Diff line number Diff line
@@ -406,7 +406,6 @@ void hisi_sas_task_deliver(struct hisi_hba *hisi_hba, 
	struct hisi_sas_cmd_hdr *cmd_hdr_base;

	int dlvry_queue_slot, dlvry_queue;

	struct sas_task *task = slot->task;

	unsigned long flags;

	int wr_q_index;



	spin_lock(&dq->lock);
@@ -460,10 +459,6 @@ void hisi_sas_task_deliver(struct hisi_hba *hisi_hba, 
		break;

	}



	spin_lock_irqsave(&task->task_state_lock, flags);

	task->task_state_flags |= SAS_TASK_AT_INITIATOR;

	spin_unlock_irqrestore(&task->task_state_lock, flags);



	WRITE_ONCE(slot->ready, 1);



	spin_lock(&dq->lock);
@@ -1038,8 +1033,7 @@ static void hisi_sas_do_release_task(struct hisi_hba *hisi_hba, struct sas_task 
		ts->resp = SAS_TASK_COMPLETE;

		ts->stat = SAS_ABORTED_TASK;

		spin_lock_irqsave(&task->task_state_lock, flags);

		task->task_state_flags &=

			~(SAS_TASK_STATE_PENDING | SAS_TASK_AT_INITIATOR);

		task->task_state_flags &= ~SAS_TASK_STATE_PENDING;

		if (!slot->is_internal && task->task_proto != SAS_PROTOCOL_SMP)

			task->task_state_flags |= SAS_TASK_STATE_DONE;

		spin_unlock_irqrestore(&task->task_state_lock, flags);

drivers/scsi/hisi_sas/hisi_sas_v1_hw.c

+1 −2
Original line number Diff line number Diff line
@@ -1200,8 +1200,7 @@ static void slot_complete_v1_hw(struct hisi_hba *hisi_hba, 
	sas_dev = device->lldd_dev;



	spin_lock_irqsave(&task->task_state_lock, flags);

	task->task_state_flags &=

		~(SAS_TASK_STATE_PENDING | SAS_TASK_AT_INITIATOR);

	task->task_state_flags &= ~SAS_TASK_STATE_PENDING;

	task->task_state_flags |= SAS_TASK_STATE_DONE;

	spin_unlock_irqrestore(&task->task_state_lock, flags);

drivers/scsi/hisi_sas/hisi_sas_v2_hw.c

+1 −2
Original line number Diff line number Diff line
@@ -2344,8 +2344,7 @@ static void slot_complete_v2_hw(struct hisi_hba *hisi_hba, 
	sas_dev = device->lldd_dev;



	spin_lock_irqsave(&task->task_state_lock, flags);

	task->task_state_flags &=

		~(SAS_TASK_STATE_PENDING | SAS_TASK_AT_INITIATOR);

	task->task_state_flags &= ~SAS_TASK_STATE_PENDING;

	spin_unlock_irqrestore(&task->task_state_lock, flags);



	memset(ts, 0, sizeof(*ts));

drivers/scsi/hisi_sas/hisi_sas_v3_hw.c

+1 −2
Original line number Diff line number Diff line
@@ -2217,8 +2217,7 @@ static void slot_complete_v3_hw(struct hisi_hba *hisi_hba, 
	sas_dev = device->lldd_dev;



	spin_lock_irqsave(&task->task_state_lock, flags);

	task->task_state_flags &=

		~(SAS_TASK_STATE_PENDING | SAS_TASK_AT_INITIATOR);

	task->task_state_flags &= ~SAS_TASK_STATE_PENDING;

	spin_unlock_irqrestore(&task->task_state_lock, flags);



	memset(ts, 0, sizeof(*ts));