From patchwork Mon Feb 12 18:28:14 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Madhani, Himanshu" X-Patchwork-Id: 10213865 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id F242760467 for ; Mon, 12 Feb 2018 18:28:28 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id E4D7B28AC1 for ; Mon, 12 Feb 2018 18:28:28 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id D8A3728AF8; Mon, 12 Feb 2018 18:28:28 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 08F1528AC1 for ; Mon, 12 Feb 2018 18:28:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753417AbeBLS20 (ORCPT ); Mon, 12 Feb 2018 13:28:26 -0500 Received: from mail-bl2nam02on0060.outbound.protection.outlook.com ([104.47.38.60]:26995 "EHLO NAM02-BL2-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1752478AbeBLS2V (ORCPT ); Mon, 12 Feb 2018 13:28:21 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=CAVIUMNETWORKS.onmicrosoft.com; s=selector1-cavium-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=pUetWZgfEGVtCp0cpZn2lEVkhA/wv+jXrIji7fZwE40=; b=JBzqlayeVIWLTKWQH3RB8Kpkm1/i6fa6Vxa+E5a3uIRE8AzkmGYRfszyB2PpaBNTM6D3LC0yqkxvmNvjREAVTBCZWh4ibitJ71g5dJYCB8SMFz6YrTTTuJ7SXAPu+WNAEIdDiEHFDTTNMKlMod5CM2Mdxy6zacxlIxxT3nfZgiI= Received: from BY2PR07CA0031.namprd07.prod.outlook.com (2a01:111:e400:7bff::26) by BL2PR07MB2356.namprd07.prod.outlook.com (2a01:111:e400:c753::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.485.10; Mon, 12 Feb 2018 18:28:19 +0000 Received: from BN1BFFO11FD031.protection.gbl (2a01:111:f400:7c10::1:192) by BY2PR07CA0031.outlook.office365.com (2a01:111:e400:7bff::26) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.485.10 via Frontend Transport; Mon, 12 Feb 2018 18:28:18 +0000 Authentication-Results: spf=fail (sender IP is 50.232.66.26) smtp.mailfrom=cavium.com; vger.kernel.org; dkim=none (message not signed) header.d=none; vger.kernel.org; dmarc=none action=none header.from=cavium.com; Received-SPF: Fail (protection.outlook.com: domain of cavium.com does not designate 50.232.66.26 as permitted sender) receiver=protection.outlook.com; client-ip=50.232.66.26; helo=CAEXCH02.caveonetworks.com; Received: from CAEXCH02.caveonetworks.com (50.232.66.26) by BN1BFFO11FD031.mail.protection.outlook.com (10.58.144.94) with Microsoft SMTP Server (version=TLS1_0, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384) id 15.20.485.12 via Frontend Transport; Mon, 12 Feb 2018 18:28:18 +0000 Received: from dut1171.mv.qlogic.com (172.29.51.171) by CAEXCH02.caveonetworks.com (10.17.4.29) with Microsoft SMTP Server id 14.2.347.0; Mon, 12 Feb 2018 10:28:15 -0800 Received: from dut1171.mv.qlogic.com (localhost [127.0.0.1]) by dut1171.mv.qlogic.com (8.14.7/8.14.7) with ESMTP id w1CISEU3004576; Mon, 12 Feb 2018 10:28:14 -0800 Received: (from root@localhost) by dut1171.mv.qlogic.com (8.14.7/8.14.7/Submit) id w1CISEpb004575; Mon, 12 Feb 2018 10:28:14 -0800 From: Himanshu Madhani To: , CC: , Subject: [PATCH] qla2xxx: Fix NULL pointer crash due to active timer for ABTS Date: Mon, 12 Feb 2018 10:28:14 -0800 Message-ID: <20180212182814.4541-1-himanshu.madhani@cavium.com> X-Mailer: git-send-email 2.12.0 MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-Forefront-Antispam-Report: CIP:50.232.66.26; IPV:NLI; CTRY:US; EFV:NLI; SFV:NSPM; SFS:(10009020)(39380400002)(346002)(396003)(39850400004)(376002)(2980300002)(1109001)(1110001)(339900001)(199004)(189003)(316002)(87636003)(54906003)(110136005)(16586007)(5660300001)(478600001)(81166006)(81156014)(8936002)(575784001)(8676002)(86362001)(106466001)(42186006)(2906002)(1076002)(69596002)(72206003)(59450400001)(47776003)(51416003)(356003)(80596001)(26005)(4326008)(1857600001)(336011)(85426001)(50466002)(105606002)(50226002)(48376002)(36756003)(305945005)(186003); DIR:OUT; SFP:1101; SCL:1; SRVR:BL2PR07MB2356; H:CAEXCH02.caveonetworks.com; FPR:; SPF:Fail; PTR:50-232-66-26-static.hfc.comcastbusiness.net; A:1; MX:1; LANG:en; X-Microsoft-Exchange-Diagnostics: 1; BN1BFFO11FD031; 1:4+yJC4Q5K+Z7pxAGzxjr51bD1t5o6HaMZIO0GeQ/WNmLipBalaROsjKz2Za7+lTO3Ck/Qr+33bjCs1TaltyjtUjCcYFQN/6IyYUlKTWTFpBVRugBpvqVy9/zJ5+ESPSV X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 8654e044-7188-4f3f-4349-08d57246638d X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652020)(5600026)(4604075)(4534165)(4627221)(201703031133081)(201702281549075)(2017052603307)(7153060); SRVR:BL2PR07MB2356; X-Microsoft-Exchange-Diagnostics: 1; BL2PR07MB2356; 3:nsNp2MTuGObTRMQVUCtHTJDrwtnVleTHWVy7ojBuRLPx7DabXrVaQaZbo22qdWIfokraNdZrIU4q7NJ6+07s8/ADHBLOtSHcabO4mc6t+CPKKR4683eHjTkG9DndLn2ESIJqBttNn9UzofXmxXEqcSQjyBkMuzq0EphfVKnNWV5zRx+UPG+uYo6Q+1A0h07QaxbyEk+zh/A4+GUD9JOZ4XDgb8XqUELeCBsNEawvtukS/Mten93YR/mYNYsImf6uNuWTv1CAVntnHKExgm+Vkn3PtvkuZfPQiXl5Tjj4hdqdwWR4h/tX4p9qtpWS89SvxzQgOGYYWNdtRkt0utRi+H6869SXVKnUGx+J43btPW8=; 25:oVrToNdkSCpqW+lYxFBQo8sHpcofMfHfreXnpvjrdvnO+5p3zT73nGLxKLQK6PI5eAepE9CPaxK4pmHsjUWspn/IIWxwYHbtOpfWDLsMg85zARQZBmFAlyfb/RuSRpCGiPLrvZd+7Al1spp4SBg0LL0rTuPVWpP63rxH18fQ6JLe4XNMSF2vlxAr7lGMv1W2gUkfGSnpkCX6u2WsSIb2CL/5WClOAP2gz9K42hHylFqM/96MQcvEIGttuBkU27lBjk9OyH/3eQ6gAjDSeh8WwQ8GDkjC4+yWHnvIP9rZ8lW7JsKRw2d/01QyZPThNqBvrTbWkUXqRSAjbKNse0rRZA== X-MS-TrafficTypeDiagnostic: BL2PR07MB2356: X-Microsoft-Exchange-Diagnostics: 1; BL2PR07MB2356; 31:KkOC0RdbV5EIf8Zo5Vu/FgF28i0f8dG7Pe83ywV5lbyti6prp/htlIbLD06wfT3eRgt+iNfb8YKbys5kbN6uWgMVg48IMEEteOExbt2h88eDoxdsecBgPNYS2Z/DI6Afqnx5pX+12xEkWQBoRYK0punmiBVwPtm4BSxOV5+Upm91Hsb0J+q2nN6/eVBV/5JMRI92LFsjZLiwSGWOZWPUb+OdrgDDn79E+oCSFeHMm8M=; 20:1sYdC0mtXSOmQ6SsknHq+iAUTgFN614yAM2vIDY9/3/NgQ0YeSRtbqMxtbOByS4vFRSmIY0u/D4lSB2iAeDEqb6kAs9I+G0lJGUEgb9pPgt0SgGUWHe7KyQtwHGGPGgJ7RkET2D2wHQS4H6mUhS3g54nBbqo50YXH+KWAnPtqzbaxf/rM1Tt1Q6DP07pKEEBZtGJsRieq5mMqq4iw6yJUtj4v8THyN8NN3sgpBAq3gqQ6na5N9r4M5tNt+lKB7NAXlu/LJQs3ezW2ThWOLNXDSixKAGii0KgL2VK6xHQSRGT4+aHW6QUUUAw0GIR31h1MxioGEJtrH1Vpm9jmWmPkATNQL3lV1YefClogrraDjk4FJYz8HprNfou/7yxq0ZrMpPc3CCfkViWVq/PxGPAA1nbCQ1PG9ubehjAX8w757TlxnwyjjCohh4AImchdPcsvxbGLuNPpaLefpwDiGIgEq20W4ghhN5YFO9OnvKbEnBn2xP08QYn2Fv58AsVokog X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:; X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040501)(2401047)(8121501046)(5005006)(3002001)(10201501046)(93006095)(93001095)(3231101)(2400082)(944501161)(6041288)(20161123564045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123558120)(20161123560045)(20161123562045)(6072148)(201708071742011); SRVR:BL2PR07MB2356; BCL:0; PCL:0; RULEID:; SRVR:BL2PR07MB2356; X-Microsoft-Exchange-Diagnostics: 1; BL2PR07MB2356; 4:V1lRea5c71m/qnFcKsIkBKGgv6SURfZsAYvE8p94ATZdHCvcwinPJUMUnFibjfcbgBlHYe68IYGN6kuUfu2v9TP95sEXotnjCeUDsltilO7Zet6nTtDxs2WFHNDY/S4QEeukIaio1HV1vqNeSer5MQpG5gu0XwBI7ma7hU5zSrSzSvnb/Q0jaRMUKp8gcVhxl0X815sZt5BQgmIRcJA8JnfAMbhbNybj2X7HdPLkjaQFee60pIhHuZs75kr2+AAhEXbvVYBbfe+rwlnvRLo43Q== X-Forefront-PRVS: 0581B5AB35 X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; BL2PR07MB2356; 23:LGZ5LCrqGHzINs5vOlBkXXVuKgTbsQFoEEOww1YRT?= =?us-ascii?Q?Wj6kQsMajO+yXIapDzT6r4EWYBL1QtvN/d6whk2giLVMrw/hboDVnftTgRcA?= =?us-ascii?Q?19/Z6xdWQisKue1YvPbmM14hnYkgSxKn/a7OO3KYClxczzPYcvRzwZoPyjMn?= =?us-ascii?Q?Lk1cN9fAF3u3z+PLI/16acAmaZjqal+jD0MAe5zQhnb56Z7PIQgROTbiHf6c?= =?us-ascii?Q?Cv13IB772pCnIOfmWLutFMqCYMBx9Y2b1wWwBWCtwZxg3fnOaaQgmaCr0VbA?= =?us-ascii?Q?QvW6PFN2uFawJfxsFWSVxFBPQeQ9yFb4kYe+hz8jmhTv4Yzkud7Gx+JV3qWk?= =?us-ascii?Q?rM3gVaKqvE+FraZ4pQHIi4kco4zBxtPKoeL+DOX5Ebqkoo3hakPEBY0rUiYM?= =?us-ascii?Q?fVC1kl4jqg/io5NQYn6OUZ+aCephD4xCGVM3C7+dusq+eo0gtHjnnEzCgTs6?= =?us-ascii?Q?HLrKNKNQJgY/sD/HDBMSVuI12lAzJWn38QusJYOEZ1OGLtKNVEv2FX58qm+N?= =?us-ascii?Q?PYfpdtiCp6yeFS4Fk1sUOnZSKKdnIm0RN6174eMGROHpGSuygMMAr90pqogc?= =?us-ascii?Q?nRLdpapu6mzLdmECkLH3TacITNX5fy70gaffeK/gDvh80guK0buiW1fzZaER?= =?us-ascii?Q?oO9tP1v5jvCY/upcgwdCTgxhmr+Qn6PoqlEWFriJpZFn+X8bnNefA7dQZYBZ?= =?us-ascii?Q?LFH+t8KfiiQ2zStpTlkAOmnVkgLLrO9WpLTQzdPpdG1xq0dQfbHSyn8z39G9?= =?us-ascii?Q?OfmkRfxyIVOX2HRA4eZ6fgG4Ms7YuzEAtpy2LKLbLbD+rOT8aOSu+sUQJF3b?= =?us-ascii?Q?I2jKcgU1vGMr93nzrTYsaj+QsL95Rx12vGkuuF0jW0TNme+jlQrVhzAWUsj8?= =?us-ascii?Q?DUw+91hmGJezi3LubPXQNAt/fmRIN4zkBseA2dlHiHrQBbsAx5xeLQa9q1Aj?= =?us-ascii?Q?43tYSLXihqCTBSPJDAiQPr+4Cdv7QFgMR6f5ikVZyevZFVhLyW1aFyz2hGz+?= =?us-ascii?Q?8PoZ3HcK6aF7hpGC/yOnqteglaGCgyN18Q3gtsSkslE1syhZAUIRbbckeZ6O?= =?us-ascii?Q?lU4sctUV13mIpqhGV/eBj7Sn1X5Fkq+Nl6jMlhyMFHbPeDYzQ=3D=3D?= X-Microsoft-Exchange-Diagnostics: 1; BL2PR07MB2356; 6:Nu81oFrmsOfyOmQdMqIyyW9XMdvMrEZnBGRQ2Po4K1Ttr0fsRCC2WaQdZWQwBghReJtHL/HIptcyOlH1Ufhu7jFn3o7cNpMl0t7wB8IvcBWsjdnkZjiie0zGdC5Kbt9y5gNjMqf13/IquDexoJWISQXuav6/8fTxVLqIxF/bzos87P4gyqxfF9dIiKRKd3uixNu+Iza/XIdbhOPA7OAJjB+WyDW+N0if4Mtlzv2BMyzAFOxgQ5ahqfxf1c/uBvCfuMFQvhywZGBFmiWGx2jaYzsAV7SlkVmXMGPkdgv/72uxn+OrMxgTGNxsCbpGMLG0lTxflOOB1u4+uBPWQLmYnBx5PTctQiTjCvyToBLgUaA=; 5:VfjTnn8dqAVrsJjxIsBl6jkRGRc+sRSFTmzO3cpXyjV9i4hAfB1NltL3v4QnZJbovtrgrE5y6MZmtS4ZYpZrqEB4sy7yrYcY7HeAXL0tBnrsAv+dimbdUzon0lx1N4pf63MY6zRLQpCbRJazBvaKvV+AcdSWIU3XH+Gk2XJc+sU=; 24:VR4C9G5CJ+5hiXTOeZ7vMeEgyLUSXl/+fffIz7Uhqg+dbDmOM5LxKJywfquXOtzm9DvVQhMZTjl43bk6DNSFUg+d8Nb9Z0GPyTnXUxOwcUY=; 7:XaRwgW1Ctw/B8aPDn1SYBeo0PqIQhAGgolvCwE3OrBtK8N1bjxoLxT6wzJJQHGinawZNSa1jhpxLVlCcAxLELyKlYX/8nYXrCf4dTc+ipySFglFh3NiH4uipjpB7DcXt1e0VEfF19Z3/N+8dGTmVsn+l5UL6d7DKE/mRvOv25XSJ9K6o8vyCoVHfdP53wwca3X7TZQK/e/Yn2mXPAdLopDRma4KMZUPOW2yiee0Ysnrt/WWIVzRZlqIsQ+4Djseb SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-OriginatorOrg: cavium.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 12 Feb 2018 18:28:18.2840 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 8654e044-7188-4f3f-4349-08d57246638d X-MS-Exchange-CrossTenant-Id: 711e4ccf-2e9b-4bcf-a551-4094005b6194 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=711e4ccf-2e9b-4bcf-a551-4094005b6194; Ip=[50.232.66.26]; Helo=[CAEXCH02.caveonetworks.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL2PR07MB2356 Sender: linux-scsi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-scsi@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP This patch fixes NULL pointer crash due to active timer running for abort IOCB. From crash dump analysis it was discoverd that get_next_timer_interrupt() encountered a corrupted entry on the timer list. #9 [ffff95e1f6f0fd40] page_fault at ffffffff914fe8f8 [exception RIP: get_next_timer_interrupt+440] RIP: ffffffff90ea3088 RSP: ffff95e1f6f0fdf0 RFLAGS: 00010013 RAX: ffff95e1f6451028 RBX: 000218e2389e5f40 RCX: 00000001232ad600 RDX: 0000000000000001 RSI: ffff95e1f6f0fdf0 RDI: 0000000001232ad6 RBP: ffff95e1f6f0fe40 R8: ffff95e1f6451188 R9: 0000000000000001 R10: 0000000000000016 R11: 0000000000000016 R12: 00000001232ad5f6 R13: ffff95e1f6450000 R14: ffff95e1f6f0fdf8 R15: ffff95e1f6f0fe10 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 Looking at the assembly of get_next_timer_interrupt(), address came from %r8 (ffff95e1f6451188) which is pointing to list_head with single entry at ffff95e5ff621178. 0xffffffff90ea307a : mov (%r8),%rdx 0xffffffff90ea307d : cmp %r8,%rdx 0xffffffff90ea3080 : je 0xffffffff90ea30a7 0xffffffff90ea3082 : nopw 0x0(%rax,%rax,1) 0xffffffff90ea3088 : testb $0x1,0x18(%rdx) crash> rd ffff95e1f6451188 10 ffff95e1f6451188: ffff95e5ff621178 ffff95e5ff621178 x.b.....x.b..... ffff95e1f6451198: ffff95e1f6451198 ffff95e1f6451198 ..E.......E..... ffff95e1f64511a8: ffff95e1f64511a8 ffff95e1f64511a8 ..E.......E..... ffff95e1f64511b8: ffff95e77cf509a0 ffff95e77cf509a0 ...|.......|.... ffff95e1f64511c8: ffff95e1f64511c8 ffff95e1f64511c8 ..E.......E..... crash> rd ffff95e5ff621178 10 ffff95e5ff621178: 0000000000000001 ffff95e15936aa00 ..........6Y.... ffff95e5ff621188: 0000000000000000 00000000ffffffff ................ ffff95e5ff621198: 00000000000000a0 0000000000000010 ................ ffff95e5ff6211a8: ffff95e5ff621198 000000000000000c ..b............. ffff95e5ff6211b8: 00000f5800000000 ffff95e751f8d720 ....X... ..Q.... ffff95e5ff621178 belongs to freed mempool object at ffff95e5ff621080. CACHE NAME OBJSIZE ALLOCATED TOTAL SLABS SSIZE ffff95dc7fd74d00 mnt_cache 384 19785 24948 594 16k SLAB MEMORY NODE TOTAL ALLOCATED FREE ffffdc5dabfd8800 ffff95e5ff620000 1 42 29 13 FREE / [ALLOCATED] ffff95e5ff621080 (cpu 6 cache) Examining the contents of that memory reveals a pointer to a constant string in the driver, "abort\0", which is set by qla24xx_async_abort_cmd(). crash> rd ffffffffc059277c 20 ffffffffc059277c: 6e490074726f6261 0074707572726574 abort.Interrupt. ffffffffc059278c: 00676e696c6c6f50 6920726576697244 Polling.Driver i ffffffffc059279c: 646f6d207325206e 6974736554000a65 n %s mode..Testi ffffffffc05927ac: 636976656420676e 786c252074612065 ng device at %lx ffffffffc05927bc: 6b63656843000a2e 646f727020676e69 ...Checking prod ffffffffc05927cc: 6f20444920746375 0a2e706968632066 uct ID of chip.. ffffffffc05927dc: 5120646e756f4600 204130303232414c .Found QLA2200A ffffffffc05927ec: 43000a2e70696843 20676e696b636568 Chip...Checking ffffffffc05927fc: 65786f626c69616d 6c636e69000a2e73 mailboxes...incl ffffffffc059280c: 756e696c2f656475 616d2d616d642f78 ude/linux/dma-ma crash> struct -ox srb_iocb struct srb_iocb { union { struct {...} logio; struct {...} els_logo; struct {...} tmf; struct {...} fxiocb; struct {...} abt; struct ct_arg ctarg; struct {...} mbx; struct {...} nack; [0x0 ] } u; [0xb8] struct timer_list timer; [0x108] void (*timeout)(void *); } SIZE: 0x110 crash> ! bc ibase=16 obase=10 B8+40 F8 The object is a srb_t, and at offset 0xf8 within that structure (i.e. ffff95e5ff621080 + f8 -> ffff95e5ff621178) is a struct timer_list. Cc: #4.4+ Signed-off-by: Himanshu Madhani Reviewed-by: Johannes Thumshirn --- Hi Martin, This patch addresses crash due to NULL pointer access because driver left active timer running for abort IOCB. Please apply this patch to 4.16/scsi-fixes at your earliest convenience. Thanks, Himanshu --- drivers/scsi/qla2xxx/qla_init.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c index 2dea1129d396..04870621e712 100644 --- a/drivers/scsi/qla2xxx/qla_init.c +++ b/drivers/scsi/qla2xxx/qla_init.c @@ -1527,6 +1527,7 @@ qla24xx_abort_sp_done(void *ptr, int res) srb_t *sp = ptr; struct srb_iocb *abt = &sp->u.iocb_cmd; + del_timer(&sp->u.iocb_cmd.timer); complete(&abt->u.abt.comp); }