git.ipfire.org Git - thirdparty/kernel/stable-queue.git/blob

   1 From 6ca9818d1624e136a76ae8faedb6b6c95ca66903 Mon Sep 17 00:00:00 2001
   2 From: Wenchao Hao <haowenchao2@huawei.com>
   3 Date: Mon, 15 May 2023 15:01:55 +0800
   4 Subject: scsi: Revert "scsi: core: Do not increase scsi_device's iorequest_cnt if dispatch failed"
   5
   6 From: Wenchao Hao <haowenchao2@huawei.com>
   7
   8 commit 6ca9818d1624e136a76ae8faedb6b6c95ca66903 upstream.
   9
  10 The "atomic_inc(&cmd->device->iorequest_cnt)" in scsi_queue_rq() would
  11 cause kernel panic because cmd->device may be freed after returning from
  12 scsi_dispatch_cmd().
  13
  14 This reverts commit cfee29ffb45b1c9798011b19d454637d1b0fe87d.
  15
  16 Signed-off-by: Wenchao Hao <haowenchao2@huawei.com>
  17 Reported-by: Ming Lei <ming.lei@redhat.com>
  18 Closes: https://lore.kernel.org/r/ZF+zB+bB7iqe0wGd@ovpn-8-17.pek2.redhat.com
  19 Link: https://lore.kernel.org/r/20230515070156.1790181-2-haowenchao2@huawei.com
  20 Reviewed-by: Ming Lei <ming.lei@redhat.com>
  21 Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
  22 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  23 ---
  24  drivers/scsi/scsi_lib.c |    3 ++-
  25  1 file changed, 2 insertions(+), 1 deletion(-)
  26
  27 --- a/drivers/scsi/scsi_lib.c
  28 +++ b/drivers/scsi/scsi_lib.c
  29 @@ -1463,6 +1463,8 @@ static int scsi_dispatch_cmd(struct scsi
  30         struct Scsi_Host *host = cmd->device->host;
  31         int rtn = 0;
  32
  33 +       atomic_inc(&cmd->device->iorequest_cnt);
  34 +
  35         /* check if the device is still usable */
  36         if (unlikely(cmd->device->sdev_state == SDEV_DEL)) {
  37                 /* in SDEV_DEL we error all commands. DID_NO_CONNECT
  38 @@ -1761,7 +1763,6 @@ static blk_status_t scsi_queue_rq(struct
  39                 goto out_dec_host_busy;
  40         }
  41
  42 -       atomic_inc(&cmd->device->iorequest_cnt);
  43         return BLK_STS_OK;
  44
  45  out_dec_host_busy: