ata: libata-core: improve tag checks in ata_qc_issue()

Make sure to check that the tag of a queued command is valid when
ata_qc_issue() is called, and fail the QC if the tag is not valid, or if
there is an on-going non-NCQ command already on the link.

Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Hannes Reinecke <hare@suse.de>

diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 11909417f0178547149012edbf97e6a4382bd895..d61846f03edcbca37783dbb260c26aa91e03dde3 100644 (file)
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -5146,8 +5146,13 @@ void ata_qc_issue(struct ata_queued_cmd *qc)
        struct ata_link *link = qc->dev->link;
        u8 prot = qc->tf.protocol;
 
-       /* Make sure only one non-NCQ command is outstanding. */
-       WARN_ON_ONCE(ata_tag_valid(link->active_tag));
+       /*
+        * Make sure we have a valid tag and that only one non-NCQ command is
+        * outstanding.
+        */
+       if (WARN_ON_ONCE(!ata_tag_valid(qc->tag)) ||
+           WARN_ON_ONCE(ata_tag_valid(link->active_tag)))
+               goto sys_err;
 
        if (ata_is_ncq(prot)) {
                WARN_ON_ONCE(link->sactive & (1 << qc->hw_tag));