scsi: target: tcm_loop: Fix wrong abort tag

When the tcm_loop_nr_hw_queues is set to a value greater than 1, the
tags of requests in the block layer are no longer unique. This may lead
to erroneous aborting of commands with the same tag. The issue can be
resolved by using blk_mq_unique_tag to generate globally unique
identifiers by combining the hardware queue index and per-queue tags.

Fixes: 6375f8908255 ("tcm_loop: Fixup tag handling")
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Link: https://lore.kernel.org/r/20250313014728.105849-1-kanie@linux.alibaba.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

diff --git a/drivers/target/loopback/tcm_loop.c b/drivers/target/loopback/tcm_loop.c
index 761c511aea07c9dfc523383a7aa6b5b86fc15e4a..c7b7da6297418f0ab5763f9ef9d471e8f32814bb 100644 (file)
--- a/drivers/target/loopback/tcm_loop.c
+++ b/drivers/target/loopback/tcm_loop.c
@@ -176,7 +176,7 @@ static int tcm_loop_queuecommand(struct Scsi_Host *sh, struct scsi_cmnd *sc)
 
        memset(tl_cmd, 0, sizeof(*tl_cmd));
        tl_cmd->sc = sc;
-       tl_cmd->sc_cmd_tag = scsi_cmd_to_rq(sc)->tag;
+       tl_cmd->sc_cmd_tag = blk_mq_unique_tag(scsi_cmd_to_rq(sc));
 
        tcm_loop_target_queue_cmd(tl_cmd);
        return 0;
@@ -242,7 +242,8 @@ static int tcm_loop_abort_task(struct scsi_cmnd *sc)
        tl_hba = *(struct tcm_loop_hba **)shost_priv(sc->device->host);
        tl_tpg = &tl_hba->tl_hba_tpgs[sc->device->id];
        ret = tcm_loop_issue_tmr(tl_tpg, sc->device->lun,
-                                scsi_cmd_to_rq(sc)->tag, TMR_ABORT_TASK);
+                                blk_mq_unique_tag(scsi_cmd_to_rq(sc)),
+                                TMR_ABORT_TASK);
        return (ret == TMR_FUNCTION_COMPLETE) ? SUCCESS : FAILED;
 }