]> git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/commit
scsi: megaraid_sas: Fix concurrent access to ISR between IRQ polling and real interrupt
authorSumit Saxena <sumit.saxena@broadcom.com>
Wed, 29 Sep 2021 12:40:20 +0000 (18:10 +0530)
committerAndrea Righi <andrea.righi@canonical.com>
Tue, 7 Dec 2021 06:33:17 +0000 (07:33 +0100)
commit3141daae40f58b210185b5984863c049a20d3895
tree9703e4899f334b210bc50bec18ba0ef83ae04d1f
parentff3c7c2a81ef0700c9bd0e4d094997a8ea1195e7
scsi: megaraid_sas: Fix concurrent access to ISR between IRQ polling and real interrupt

BugLink: https://bugs.launchpad.net/bugs/1951822
[ Upstream commit e7dcc514a49e74051b869697d5ab0370f6301d57 ]

IRQ polling thread calls ISR after enable_irq() to handle any missed I/O
completion. The atomic flag "in_used" was added to have the synchronization
between the IRQ polling thread and the interrupt context. There is a bug
around it leading to a race condition.

Below is the sequence:

 - IRQ polling thread accesses ISR, fetches the reply descriptor.

 - Real interrupt arrives and pre-empts polling thread (enable_irq() is
   already called).

 - Interrupt context picks the same reply descriptor as fetched by polling
   thread, processes it, and exits.

 - Polling thread resumes and processes the descriptor which is already
   processed by interrupt thread leads to kernel crash.

Setting the "in_used" flag before fetching the reply descriptor ensures
synchronized access to ISR.

Link: https://www.spinics.net/lists/linux-scsi/msg159440.html
Link: https://lore.kernel.org/r/20210929124022.24605-2-sumit.saxena@broadcom.com
Fixes: 9bedd36e9146 ("scsi: megaraid_sas: Handle missing interrupts while re-enabling IRQs")
Signed-off-by: Sumit Saxena <sumit.saxena@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Paolo Pisati <paolo.pisati@canonical.com>
drivers/scsi/megaraid/megaraid_sas_fusion.c