diff options
author | Jason Gunthorpe <jgg@mellanox.com> | 2018-08-16 13:08:18 -0600 |
---|---|---|
committer | Jason Gunthorpe <jgg@mellanox.com> | 2018-08-16 13:12:00 -0600 |
commit | 89982f7ccee2fcd8fea7936b81eec6defbf0f131 (patch) | |
tree | fc553c8d008d24595ad7de0ea0f3b56f656da27c /drivers/scsi/scsi_error.c | |
parent | a1ceeca679dccc492235f0f629d9e9f7b3d51ca8 (diff) | |
parent | 94710cac0ef4ee177a63b5227664b38c95bbf703 (diff) | |
download | linux-89982f7ccee2fcd8fea7936b81eec6defbf0f131.tar.gz linux-89982f7ccee2fcd8fea7936b81eec6defbf0f131.tar.bz2 linux-89982f7ccee2fcd8fea7936b81eec6defbf0f131.zip |
Merge tag 'v4.18' into rdma.git for-next
Resolve merge conflicts from the -rc cycle against the rdma.git tree:
Conflicts:
drivers/infiniband/core/uverbs_cmd.c
- New ifs added to ib_uverbs_ex_create_flow in -rc and for-next
- Merge removal of file->ucontext in for-next with new code in -rc
drivers/infiniband/core/uverbs_main.c
- for-next removed code from ib_uverbs_write() that was modified
in for-rc
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Diffstat (limited to 'drivers/scsi/scsi_error.c')
-rw-r--r-- | drivers/scsi/scsi_error.c | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c index 8932ae81a15a..2715cdaa669c 100644 --- a/drivers/scsi/scsi_error.c +++ b/drivers/scsi/scsi_error.c @@ -296,6 +296,20 @@ enum blk_eh_timer_return scsi_times_out(struct request *req) rtn = host->hostt->eh_timed_out(scmd); if (rtn == BLK_EH_DONE) { + /* + * For blk-mq, we must set the request state to complete now + * before sending the request to the scsi error handler. This + * will prevent a use-after-free in the event the LLD manages + * to complete the request before the error handler finishes + * processing this timed out request. + * + * If the request was already completed, then the LLD beat the + * time out handler from transferring the request to the scsi + * error handler. In that case we can return immediately as no + * further action is required. + */ + if (req->q->mq_ops && !blk_mq_mark_complete(req)) + return rtn; if (scsi_abort_command(scmd) != SUCCESS) { set_host_byte(scmd, DID_TIME_OUT); scsi_eh_scmd_add(scmd); |