ncr5380: Dont re-enter NCR5380_select()

Calling NCR5380_select() from the abort handler causes various problems.
Firstly, it means potentially re-entering NCR5380_select(). Secondly, it
means that the lock is released, which permits the EH handlers to be
re-entered. The combination results in crashes. Don't do it.

Fixes: 8b00c3d5d40d ("ncr5380: Implement new eh_abort_handler")
Reported-and-tested-by: Michael Schmitz <schmitzmic@gmail.com>
Cc: <stable@vger.kernel.org> # 4.5
Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c
index 0e00d487ceb48fcb004256d07ac53afae595b26e..5daab045c06397472952d7862b825375d7b1d3f6 100644 (file)
--- a/drivers/scsi/NCR5380.c
+++ b/drivers/scsi/NCR5380.c
@@ -2302,6 +2302,9 @@ static bool list_del_cmd(struct list_head *haystack,
  * If cmd was not found at all then presumably it has already been completed,
  * in which case return SUCCESS to try to avoid further EH measures.
  * If the command has not completed yet, we must not fail to find it.
+ *
+ * The lock protects driver data structures, but EH handlers also use it
+ * to serialize their own execution and prevent their own re-entry.
  */
 
 static int NCR5380_abort(struct scsi_cmnd *cmd)
@@ -2338,14 +2341,11 @@ static int NCR5380_abort(struct scsi_cmnd *cmd)
        if (list_del_cmd(&hostdata->disconnected, cmd)) {
                dsprintk(NDEBUG_ABORT, instance,
                         "abort: removed %p from disconnected list\n", cmd);
-               cmd->result = DID_ERROR << 16;
-               if (!hostdata->connected)
-                       NCR5380_select(instance, cmd);
-               if (hostdata->connected != cmd) {
-                       complete_cmd(instance, cmd);
-                       result = FAILED;
-                       goto out;
-               }
+               /* Can't call NCR5380_select() and send ABORT because that
+                * means releasing the lock. Need a bus reset.
+                */
+               result = FAILED;
+               goto out;
        }
 
        if (hostdata->connected == cmd) {

diff --git a/drivers/scsi/atari_NCR5380.c b/drivers/scsi/atari_NCR5380.c
index d382e71f4f4e00c4a2481b3e00f70f52cff2b8bc..19a2fb3e6e7f4a2e8e72337c650dd84581dff419 100644 (file)
--- a/drivers/scsi/atari_NCR5380.c
+++ b/drivers/scsi/atari_NCR5380.c
@@ -2497,6 +2497,9 @@ static bool list_del_cmd(struct list_head *haystack,
  * If cmd was not found at all then presumably it has already been completed,
  * in which case return SUCCESS to try to avoid further EH measures.
  * If the command has not completed yet, we must not fail to find it.
+ *
+ * The lock protects driver data structures, but EH handlers also use it
+ * to serialize their own execution and prevent their own re-entry.
  */
 
 static int NCR5380_abort(struct scsi_cmnd *cmd)
@@ -2533,14 +2536,11 @@ static int NCR5380_abort(struct scsi_cmnd *cmd)
        if (list_del_cmd(&hostdata->disconnected, cmd)) {
                dsprintk(NDEBUG_ABORT, instance,
                         "abort: removed %p from disconnected list\n", cmd);
-               cmd->result = DID_ERROR << 16;
-               if (!hostdata->connected)
-                       NCR5380_select(instance, cmd);
-               if (hostdata->connected != cmd) {
-                       complete_cmd(instance, cmd);
-                       result = FAILED;
-                       goto out;
-               }
+               /* Can't call NCR5380_select() and send ABORT because that
+                * means releasing the lock. Need a bus reset.
+                */
+               result = FAILED;
+               goto out;
        }
 
        if (hostdata->connected == cmd) {