libata: fix EH locking

Wrap ata_qc_complete() calls in EH context in spinlocks, to prevent
races (mainly in ATAPI code paths).

diff --git a/drivers/scsi/ahci.c b/drivers/scsi/ahci.c
index 348493982b56d550486497fa3de9294ac5bc1f10..841f4e2cfe087802a4ba3cc0935ddc2a98bc0fbe 100644 (file)
--- a/drivers/scsi/ahci.c
+++ b/drivers/scsi/ahci.c
@@ -586,12 +586,16 @@ static void ahci_intr_error(struct ata_port *ap, u32 irq_stat)
 
 static void ahci_eng_timeout(struct ata_port *ap)
 {
-       void *mmio = ap->host_set->mmio_base;
+       struct ata_host_set *host_set = ap->host_set;
+       void *mmio = host_set->mmio_base;
        void *port_mmio = ahci_port_base(mmio, ap->port_no);
        struct ata_queued_cmd *qc;
+       unsigned long flags;
 
        DPRINTK("ENTER\n");
 
+       spin_lock_irqsave(&host_set->lock, flags);
+
        ahci_intr_error(ap, readl(port_mmio + PORT_IRQ_STAT));
 
        qc = ata_qc_from_tag(ap, ap->active_tag);
@@ -609,6 +613,7 @@ static void ahci_eng_timeout(struct ata_port *ap)
                ata_qc_complete(qc, ATA_ERR);
        }
 
+       spin_unlock_irqrestore(&host_set->lock, flags);
 }
 
 static inline int ahci_host_intr(struct ata_port *ap, struct ata_queued_cmd *qc)

diff --git a/drivers/scsi/libata-core.c b/drivers/scsi/libata-core.c
index 157a3e914cb73a3c62bc4e19443edcb99d48ac3b..ec7bff73ae18d3206f6d96e84398b37e91898acf 100644 (file)
--- a/drivers/scsi/libata-core.c
+++ b/drivers/scsi/libata-core.c
@@ -2388,12 +2388,13 @@ static int ata_sg_setup(struct ata_queued_cmd *qc)
 void ata_poll_qc_complete(struct ata_queued_cmd *qc, u8 drv_stat)
 {
        struct ata_port *ap = qc->ap;
+       unsigned long flags;
 
-       spin_lock_irq(&ap->host_set->lock);
+       spin_lock_irqsave(&ap->host_set->lock, flags);
        ap->flags &= ~ATA_FLAG_NOINTR;
        ata_irq_on(ap);
        ata_qc_complete(qc, drv_stat);
-       spin_unlock_irq(&ap->host_set->lock);
+       spin_unlock_irqrestore(&ap->host_set->lock, flags);
 }
 
 /**
@@ -2973,8 +2974,10 @@ static void atapi_request_sense(struct ata_port *ap, struct ata_device *dev,
 static void ata_qc_timeout(struct ata_queued_cmd *qc)
 {
        struct ata_port *ap = qc->ap;
+       struct ata_host_set *host_set = ap->host_set;
        struct ata_device *dev = qc->dev;
        u8 host_stat = 0, drv_stat;
+       unsigned long flags;
 
        DPRINTK("ENTER\n");
 
@@ -2985,7 +2988,9 @@ static void ata_qc_timeout(struct ata_queued_cmd *qc)
                if (!(cmd->eh_eflags & SCSI_EH_CANCEL_CMD)) {
 
                        /* finish completing original command */
+                       spin_lock_irqsave(&host_set->lock, flags);
                        __ata_qc_complete(qc);
+                       spin_unlock_irqrestore(&host_set->lock, flags);
 
                        atapi_request_sense(ap, dev, cmd);
 
@@ -2996,6 +3001,8 @@ static void ata_qc_timeout(struct ata_queued_cmd *qc)
                }
        }
 
+       spin_lock_irqsave(&host_set->lock, flags);
+
        /* hack alert!  We cannot use the supplied completion
         * function from inside the ->eh_strategy_handler() thread.
         * libata is the only user of ->eh_strategy_handler() in
@@ -3029,6 +3036,9 @@ static void ata_qc_timeout(struct ata_queued_cmd *qc)
                ata_qc_complete(qc, drv_stat);
                break;
        }
+
+       spin_unlock_irqrestore(&host_set->lock, flags);
+
 out:
        DPRINTK("EXIT\n");
 }

diff --git a/drivers/scsi/sata_promise.c b/drivers/scsi/sata_promise.c
index defcc1fb3f1684e4399d1d008d3d67deffca4f58..b8dc49fed7697751eef8e8cadbf4f9a5454dee66 100644 (file)
--- a/drivers/scsi/sata_promise.c
+++ b/drivers/scsi/sata_promise.c
@@ -325,11 +325,15 @@ static void pdc_qc_prep(struct ata_queued_cmd *qc)
 
 static void pdc_eng_timeout(struct ata_port *ap)
 {
+       struct ata_host_set *host_set = ap->host_set;
        u8 drv_stat;
        struct ata_queued_cmd *qc;
+       unsigned long flags;
 
        DPRINTK("ENTER\n");
 
+       spin_lock_irqsave(&host_set->lock, flags);
+
        qc = ata_qc_from_tag(ap, ap->active_tag);
        if (!qc) {
                printk(KERN_ERR "ata%u: BUG: timeout without command\n",
@@ -363,6 +367,7 @@ static void pdc_eng_timeout(struct ata_port *ap)
        }
 
 out:
+       spin_unlock_irqrestore(&host_set->lock, flags);
        DPRINTK("EXIT\n");
 }
 

diff --git a/drivers/scsi/sata_sx4.c b/drivers/scsi/sata_sx4.c
index e2db499f22dd26c3c0b9cec584524c493fd8d6eb..a20d4285090abf71afeab2756be9511da0b21eb2 100644 (file)
--- a/drivers/scsi/sata_sx4.c
+++ b/drivers/scsi/sata_sx4.c
@@ -848,10 +848,14 @@ static irqreturn_t pdc20621_interrupt (int irq, void *dev_instance, struct pt_re
 static void pdc_eng_timeout(struct ata_port *ap)
 {
        u8 drv_stat;
+       struct ata_host_set *host_set = ap->host_set;
        struct ata_queued_cmd *qc;
+       unsigned long flags;
 
        DPRINTK("ENTER\n");
 
+       spin_lock_irqsave(&host_set->lock, flags);
+
        qc = ata_qc_from_tag(ap, ap->active_tag);
        if (!qc) {
                printk(KERN_ERR "ata%u: BUG: timeout without command\n",
@@ -885,6 +889,7 @@ static void pdc_eng_timeout(struct ata_port *ap)
        }
 
 out:
+       spin_unlock_irqrestore(&host_set->lock, flags);
        DPRINTK("EXIT\n");
 }