scsi: qedi: Protect active command list to avoid list corruption

[ Upstream commit c0650e28448d606c84f76c34333dba30f61de993 ]

Protect active command list for non-I/O commands like login response,
logout response, text response, and recovery cleanup of active list to
avoid list corruption.

Link: https://lore.kernel.org/r/20200908095657.26821-5-mrangankar@marvell.com
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Signed-off-by: Manish Rangankar <mrangankar@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/scsi/qedi/qedi_fw.c b/drivers/scsi/qedi/qedi_fw.c
index 2e5e04a7623fad85f0746aa11c5eb62f0f9afc6a..e688300faeefd64a4ed909f3725fffdcbaa4ac15 100644 (file)
--- a/drivers/scsi/qedi/qedi_fw.c
+++ b/drivers/scsi/qedi/qedi_fw.c
@@ -62,6 +62,7 @@ static void qedi_process_logout_resp(struct qedi_ctx *qedi,
                  "Freeing tid=0x%x for cid=0x%x\n",
                  cmd->task_id, qedi_conn->iscsi_conn_id);
 
+       spin_lock(&qedi_conn->list_lock);
        if (likely(cmd->io_cmd_in_list)) {
                cmd->io_cmd_in_list = false;
                list_del_init(&cmd->io_cmd);
@@ -72,6 +73,7 @@ static void qedi_process_logout_resp(struct qedi_ctx *qedi,
                          cmd->task_id, qedi_conn->iscsi_conn_id,
                          &cmd->io_cmd);
        }
+       spin_unlock(&qedi_conn->list_lock);
 
        cmd->state = RESPONSE_RECEIVED;
        qedi_clear_task_idx(qedi, cmd->task_id);
@@ -127,6 +129,7 @@ static void qedi_process_text_resp(struct qedi_ctx *qedi,
                  "Freeing tid=0x%x for cid=0x%x\n",
                  cmd->task_id, qedi_conn->iscsi_conn_id);
 
+       spin_lock(&qedi_conn->list_lock);
        if (likely(cmd->io_cmd_in_list)) {
                cmd->io_cmd_in_list = false;
                list_del_init(&cmd->io_cmd);
@@ -137,6 +140,7 @@ static void qedi_process_text_resp(struct qedi_ctx *qedi,
                          cmd->task_id, qedi_conn->iscsi_conn_id,
                          &cmd->io_cmd);
        }
+       spin_unlock(&qedi_conn->list_lock);
 
        cmd->state = RESPONSE_RECEIVED;
        qedi_clear_task_idx(qedi, cmd->task_id);
@@ -231,11 +235,13 @@ static void qedi_process_tmf_resp(struct qedi_ctx *qedi,
 
        tmf_hdr = (struct iscsi_tm *)qedi_cmd->task->hdr;
 
+       spin_lock(&qedi_conn->list_lock);
        if (likely(qedi_cmd->io_cmd_in_list)) {
                qedi_cmd->io_cmd_in_list = false;
                list_del_init(&qedi_cmd->io_cmd);
                qedi_conn->active_cmd_count--;
        }
+       spin_unlock(&qedi_conn->list_lock);
 
        if (((tmf_hdr->flags & ISCSI_FLAG_TM_FUNC_MASK) ==
              ISCSI_TM_FUNC_LOGICAL_UNIT_RESET) ||
@@ -299,11 +305,13 @@ static void qedi_process_login_resp(struct qedi_ctx *qedi,
                  ISCSI_LOGIN_RESPONSE_HDR_DATA_SEG_LEN_MASK;
        qedi_conn->gen_pdu.resp_wr_ptr = qedi_conn->gen_pdu.resp_buf + pld_len;
 
+       spin_lock(&qedi_conn->list_lock);
        if (likely(cmd->io_cmd_in_list)) {
                cmd->io_cmd_in_list = false;
                list_del_init(&cmd->io_cmd);
                qedi_conn->active_cmd_count--;
        }
+       spin_unlock(&qedi_conn->list_lock);
 
        memset(task_ctx, '\0', sizeof(*task_ctx));
 

diff --git a/drivers/scsi/qedi/qedi_iscsi.c b/drivers/scsi/qedi/qedi_iscsi.c
index 4d7971c3f339b306c38bb523988d48c90f83b146..c55fb411c8a55b95c1cdc11711aa61d67ad1934e 100644 (file)
--- a/drivers/scsi/qedi/qedi_iscsi.c
+++ b/drivers/scsi/qedi/qedi_iscsi.c
@@ -983,11 +983,13 @@ static void qedi_cleanup_active_cmd_list(struct qedi_conn *qedi_conn)
 {
        struct qedi_cmd *cmd, *cmd_tmp;
 
+       spin_lock(&qedi_conn->list_lock);
        list_for_each_entry_safe(cmd, cmd_tmp, &qedi_conn->active_cmd_list,
                                 io_cmd) {
                list_del_init(&cmd->io_cmd);
                qedi_conn->active_cmd_count--;
        }
+       spin_unlock(&qedi_conn->list_lock);
 }
 
 static void qedi_ep_disconnect(struct iscsi_endpoint *ep)