diff mbox

qla2xxx: Avoid double completion of abort command

Message ID 20180320210547.wqhncy2yxnfrmpzl@xylophone.i.decadent.org.uk (mailing list archive)
State Accepted
Headers show

Commit Message

Ben Hutchings March 20, 2018, 9:05 p.m. UTC
qla2x00_tmf_sp_done() now deletes the timer that will run
qla2x00_tmf_iocb_timeout(), but doesn't check whether the timer
already expired.  Check the return value from del_timer() to avoid
calling complete() a second time.

Fixes: 4440e46d5db7 ("[SCSI] qla2xxx: Add IOCB Abort command asynchronous ...")
Fixes: 1514839b3664 ("scsi: qla2xxx: Fix NULL pointer crash due to active ...")
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
---
 drivers/scsi/qla2xxx/qla_init.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Comments

Madhani, Himanshu March 29, 2018, 5:23 p.m. UTC | #1
Hi Ben, 

> On Mar 20, 2018, at 2:05 PM, Ben Hutchings <ben.hutchings@codethink.co.uk> wrote:
> 
> qla2x00_tmf_sp_done() now deletes the timer that will run
> qla2x00_tmf_iocb_timeout(), but doesn't check whether the timer
> already expired.  Check the return value from del_timer() to avoid
> calling complete() a second time.
> 
> Fixes: 4440e46d5db7 ("[SCSI] qla2xxx: Add IOCB Abort command asynchronous ...")
> Fixes: 1514839b3664 ("scsi: qla2xxx: Fix NULL pointer crash due to active ...")
> Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
> ---
> drivers/scsi/qla2xxx/qla_init.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
> index 00329dda6179..b0aa8cc96f0f 100644
> --- a/drivers/scsi/qla2xxx/qla_init.c
> +++ b/drivers/scsi/qla2xxx/qla_init.c
> @@ -1546,8 +1546,8 @@ qla24xx_abort_sp_done(void *ptr, int res)
> 	srb_t *sp = ptr;
> 	struct srb_iocb *abt = &sp->u.iocb_cmd;
> 
> -	del_timer(&sp->u.iocb_cmd.timer);
> -	complete(&abt->u.abt.comp);
> +	if (del_timer(&sp->u.iocb_cmd.timer))
> +		complete(&abt->u.abt.comp);
> }
> 
> int
> -- 
> 2.15.0.rc0
> 

Looks good.

Acked-by: Himanshu Madhani <himanshu.madhani@cavium.com>

Thanks,
- Himanshu
Martin K. Petersen April 10, 2018, 1:06 a.m. UTC | #2
Himanshu,

>> qla2x00_tmf_sp_done() now deletes the timer that will run
>> qla2x00_tmf_iocb_timeout(), but doesn't check whether the timer
>> already expired.  Check the return value from del_timer() to avoid
>> calling complete() a second time.

> Looks good.
>
> Acked-by: Himanshu Madhani <himanshu.madhani@cavium.com>

Applied to 4.17/scsi-fixes. Thanks!
diff mbox

Patch

diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 00329dda6179..b0aa8cc96f0f 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -1546,8 +1546,8 @@  qla24xx_abort_sp_done(void *ptr, int res)
 	srb_t *sp = ptr;
 	struct srb_iocb *abt = &sp->u.iocb_cmd;
 
-	del_timer(&sp->u.iocb_cmd.timer);
-	complete(&abt->u.abt.comp);
+	if (del_timer(&sp->u.iocb_cmd.timer))
+		complete(&abt->u.abt.comp);
 }
 
 int