scsi: fix race between simultaneous decrements of ->host_failed
authorWei Fang <fangwei1@huawei.com>
Tue, 7 Jun 2016 06:53:56 +0000 (14:53 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 27 Jul 2016 16:47:39 +0000 (09:47 -0700)
commit273e12926787a667f1581546e3cec7a1ec0415b6
tree3b02d9665b745b3e2c7cefb402f081c195fc28e8
parentcf2a2c6de0516f595825c9c46eb8ebc12a48dd31
scsi: fix race between simultaneous decrements of ->host_failed

commit 72d8c36ec364c82bf1bf0c64dfa1041cfaf139f7 upstream.

sas_ata_strategy_handler() adds the works of the ata error handler to
system_unbound_wq. This workqueue asynchronously runs work items, so the
ata error handler will be performed concurrently on different CPUs. In
this case, ->host_failed will be decreased simultaneously in
scsi_eh_finish_cmd() on different CPUs, and become abnormal.

It will lead to permanently inequality between ->host_failed and
->host_busy, and scsi error handler thread won't start running. IO
errors after that won't be handled.

Since all scmds must have been handled in the strategy handler, just
remove the decrement in scsi_eh_finish_cmd() and zero ->host_busy after
the strategy handler to fix this race.

Fixes: 50824d6c5657 ("[SCSI] libsas: async ata-eh")
Signed-off-by: Wei Fang <fangwei1@huawei.com>
Reviewed-by: James Bottomley <jejb@linux.vnet.ibm.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Documentation/scsi/scsi_eh.txt
drivers/ata/libata-eh.c
drivers/scsi/scsi_error.c