scsi: lpfc: Correct panics with eh_timeout and eh_deadline

Orabug: 25486030

Correct panics with eh_timeout and eh_deadline

We were having double completions on our SLI-3 version of adapters.
Solved by clearing our command pointer before calling scsi_done.

The eh paths potentially ran simulatenously and would see the non-null
value and invoke scsi_done again.

Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: James Smart <james.smart@broadcom.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit 89533e9be08aeda5cdc4600d46c1540c7b440299)
Signed-off-by: Brian Maly <brian.maly@oracle.com>

diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
index e50341d8eaa0f5f5c9cf1ba215791bf7c1b017c1..091f1b50e57e607388df761c2f752b54fb344e2a 100644 (file)
--- a/drivers/scsi/lpfc/lpfc_scsi.c
+++ b/drivers/scsi/lpfc/lpfc_scsi.c
@@ -4139,13 +4139,13 @@ lpfc_scsi_cmd_iocb_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *pIocbIn,
 
        lpfc_scsi_unprep_dma_buf(phba, lpfc_cmd);
 
-       /* The sdev is not guaranteed to be valid post scsi_done upcall. */
-       cmd->scsi_done(cmd);
-
        spin_lock_irqsave(&phba->hbalock, flags);
        lpfc_cmd->pCmd = NULL;
        spin_unlock_irqrestore(&phba->hbalock, flags);
 
+       /* The sdev is not guaranteed to be valid post scsi_done upcall. */
+       cmd->scsi_done(cmd);
+
        /*
         * If there is a thread waiting for command completion
         * wake up the thread.

diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index f62e0b24cc08b0fddbba5f4e42c5f9cba3d2d2ca..b5cdbc6a3e3ee96f98517d5710108cb9f8820566 100644 (file)
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -2654,15 +2654,16 @@ lpfc_sli_iocbq_lookup(struct lpfc_hba *phba,
 
        if (iotag != 0 && iotag <= phba->sli.last_iotag) {
                cmd_iocb = phba->sli.iocbq_lookup[iotag];
-               list_del_init(&cmd_iocb->list);
                if (cmd_iocb->iocb_flag & LPFC_IO_ON_TXCMPLQ) {
+                       /* remove from txcmpl queue list */
+                       list_del_init(&cmd_iocb->list);
                        cmd_iocb->iocb_flag &= ~LPFC_IO_ON_TXCMPLQ;
+                       return cmd_iocb;
                }
-               return cmd_iocb;
        }
 
        lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
-                       "0317 iotag x%x is out off "
+                       "0317 iotag x%x is out of "
                        "range: max iotag x%x wd0 x%x\n",
                        iotag, phba->sli.last_iotag,
                        *(((uint32_t *) &prspiocb->iocb) + 7));
@@ -2696,8 +2697,9 @@ lpfc_sli_iocbq_lookup_by_tag(struct lpfc_hba *phba,
                        return cmd_iocb;
                }
        }
+
        lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
-                       "0372 iotag x%x is out off range: max iotag (x%x)\n",
+                       "0372 iotag x%x is out of range: max iotag (x%x)\n",
                        iotag, phba->sli.last_iotag);
        return NULL;
 }
@@ -11778,6 +11780,8 @@ lpfc_sli4_els_wcqe_to_rspiocbq(struct lpfc_hba *phba,
        /* Look up the ELS command IOCB and create pseudo response IOCB */
        cmdiocbq = lpfc_sli_iocbq_lookup_by_tag(phba, pring,
                                bf_get(lpfc_wcqe_c_request_tag, wcqe));
+       /* Put the iocb back on the txcmplq */
+       lpfc_sli_ringtxcmpl_put(phba, pring, cmdiocbq);
        spin_unlock_irqrestore(&pring->ring_lock, iflags);
 
        if (unlikely(!cmdiocbq)) {