Received: by 10.223.185.111 with SMTP id b44csp918895wrg; Fri, 9 Mar 2018 16:51:46 -0800 (PST) X-Google-Smtp-Source: AG47ELsbZNNICuSRovQ2ZaX/Ed4RMozbTdufnItMSUsvacY9pGm2vxlWDJeJMJOCjpZbHZvWAhmX X-Received: by 2002:a17:902:bcc5:: with SMTP id o5-v6mr405593pls.86.1520643106025; Fri, 09 Mar 2018 16:51:46 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1520643105; cv=none; d=google.com; s=arc-20160816; b=Lvzes8kCTeGY3Plmxe5ilLjmYf0+dqRBJE24daCfLEOgp4h/DgYU9EtZNBsk1W5H8j q8tUyzRQXhd/dco3vk+2mhKuG3lWamUlsL2aVHxuUvW2ylBjHXghe70R3MCywPyXolTs NEwGo+k0P3L4lr0pXsUacjBvy/LQpgp2vaAw+SgMrPkxG2DRsFxRlmphQCPSTjZzyXW6 Wd2MBn56EVBpRdl63lOL2MaPpWv/88fW0+MGRYZwKAArup1VHlTgWCJ8QmjHZngR1U0y RMSfm3kEqbjpXSLEWUBcwc0rXx6vJv6dZVT32buzOYd2FIgN9i6l7na1lx6TjBl5H9VQ 3nWw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:user-agent:references :in-reply-to:message-id:date:subject:cc:to:from :arc-authentication-results; bh=c+JBkeiz8qvLHR0Hllk/oA44/Ckoh9y4eHBySFFg/Ug=; b=YeBj5H9GfBZxCzHBCShWtQMyrA8/N8O7yTPO0pO4r1+l8ZT9IENpvmGxqypbUKmYTo uD3GfYYdrmRMGIuigYqJ0zFMM+HrXBbbggXtSFanIw0jUhPYXy94Z3H906Ygu+E4Mm2R kc0ll/VKWUtp7c9Yyln0oTh9u/Y1wQENZaxrOQvKcp/GkOpBu4iMWxta4h9sDNGqFs1c +qOaq6w+XeI5/PDA1S9WxUzK1PRJGyEy2fFs1VD+XdQtUDX2Oz7qlCGuPRJHKixwWcmJ u8zpYhx6wYGHX116l8ktucUxmdg17es7b3VXSfHutfFRaoXxVVo/v/6lToZu6Qe/K9D9 LEIw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id y5si1515808pgb.43.2018.03.09.16.51.30; Fri, 09 Mar 2018 16:51:45 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933202AbeCJAuZ (ORCPT + 99 others); Fri, 9 Mar 2018 19:50:25 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:38606 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932970AbeCJATW (ORCPT ); Fri, 9 Mar 2018 19:19:22 -0500 Received: from localhost (unknown [185.236.200.248]) by mail.linuxfoundation.org (Postfix) with ESMTPSA id BE55DF1D; Sat, 10 Mar 2018 00:19:21 +0000 (UTC) From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Julian Wiedmann , "David S. Miller" Subject: [PATCH 3.18 17/21] s390/qeth: fix IPA command submission race Date: Fri, 9 Mar 2018 16:18:39 -0800 Message-Id: <20180310001802.145536649@linuxfoundation.org> X-Mailer: git-send-email 2.16.2 In-Reply-To: <20180310001801.045114869@linuxfoundation.org> References: <20180310001801.045114869@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Julian Wiedmann [ Upstream commit d22ffb5a712f9211ffd104c38fc17cbfb1b5e2b0 ] If multiple IPA commands are build & sent out concurrently, fill_ipacmd_header() may assign a seqno value to a command that's different from what send_control_data() later assigns to this command's reply. This is due to other commands passing through send_control_data(), and incrementing card->seqno.ipa along the way. So one IPA command has no reply that's waiting for its seqno, while some other IPA command has multiple reply objects waiting for it. Only one of those waiting replies wins, and the other(s) times out and triggers a recovery via send_ipa_cmd(). Fix this by making sure that the same seqno value is assigned to a command and its reply object. Do so immediately before submitting the command & while holding the irq_pending "lock", to produce nicely ascending seqnos. As a side effect, *all* IPA commands now use a reply object that's waiting for its actual seqno. Previously, early IPA commands that were submitted while the card was still DOWN used the "catch-all" IDX seqno. Signed-off-by: Julian Wiedmann Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- drivers/s390/net/qeth_core_main.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) --- a/drivers/s390/net/qeth_core_main.c +++ b/drivers/s390/net/qeth_core_main.c @@ -2037,25 +2037,26 @@ int qeth_send_control_data(struct qeth_c } reply->callback = reply_cb; reply->param = reply_param; - if (card->state == CARD_STATE_DOWN) - reply->seqno = QETH_IDX_COMMAND_SEQNO; - else - reply->seqno = card->seqno.ipa++; + init_waitqueue_head(&reply->wait_q); - spin_lock_irqsave(&card->lock, flags); - list_add_tail(&reply->list, &card->cmd_waiter_list); - spin_unlock_irqrestore(&card->lock, flags); QETH_DBF_HEX(CTRL, 2, iob->data, QETH_DBF_CTRL_LEN); while (atomic_cmpxchg(&card->write.irq_pending, 0, 1)) ; - qeth_prepare_control_data(card, len, iob); if (IS_IPA(iob->data)) { cmd = __ipa_cmd(iob); + cmd->hdr.seqno = card->seqno.ipa++; + reply->seqno = cmd->hdr.seqno; event_timeout = QETH_IPA_TIMEOUT; } else { + reply->seqno = QETH_IDX_COMMAND_SEQNO; event_timeout = QETH_TIMEOUT; } + qeth_prepare_control_data(card, len, iob); + + spin_lock_irqsave(&card->lock, flags); + list_add_tail(&reply->list, &card->cmd_waiter_list); + spin_unlock_irqrestore(&card->lock, flags); timeout = jiffies + event_timeout; @@ -2889,7 +2890,7 @@ static void qeth_fill_ipacmd_header(stru memset(cmd, 0, sizeof(struct qeth_ipa_cmd)); cmd->hdr.command = command; cmd->hdr.initiator = IPA_CMD_INITIATOR_HOST; - cmd->hdr.seqno = card->seqno.ipa; + /* cmd->hdr.seqno is set by qeth_send_control_data() */ cmd->hdr.adapter_type = qeth_get_ipa_adp_type(card->info.link_type); cmd->hdr.rel_adapter_no = (__u8) card->info.portno; if (card->options.layer2)