From: Javed Hasan <jhasan@marvell.com>

Date: Tue, 15 Dec 2020 11:47:31 -0800

Subject: scsi: libfc: Avoid invoking response handler twice if ep is already

 completed

MIME-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

Patch-mainline: v5.11-rc5

Git-commit: b2b0f16fa65e910a3ec8771206bb49ee87a54ac5

References: bsc#1186573

A race condition exists between the response handler getting called because

of exchange_mgr_reset() (which clears out all the active XIDs) and the

response we get via an interrupt.

Sequence of events:

	 rport ba0200: Port timeout, state PLOGI

	 rport ba0200: Port entered PLOGI state from PLOGI state

	 xid 1052: Exchange timer armed : 20000 msecs      xid timer armed here

	 rport ba0200: Received LOGO request while in state PLOGI

	 rport ba0200: Delete port

	 rport ba0200: work event 3

	 rport ba0200: lld callback ev 3

	 bnx2fc: rport_event_hdlr: event = 3, port_id = 0xba0200

	 bnx2fc: ba0200 - rport not created Yet!!

	 /* Here we reset any outstanding exchanges before

	 freeing rport using the exch_mgr_reset() */

	 xid 1052: Exchange timer canceled

	 /* Here we got two responses for one xid */

	 xid 1052: invoking resp(), esb 20000000 state 3

	 xid 1052: invoking resp(), esb 20000000 state 3

	 xid 1052: fc_rport_plogi_resp() : ep->resp_active 2

	 xid 1052: fc_rport_plogi_resp() : ep->resp_active 2

Skip the response if the exchange is already completed.

Link: https://lore.kernel.org/r/20201215194731.2326-1-jhasan@marvell.com

Signed-off-by: Javed Hasan <jhasan@marvell.com>

Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

Acked-by: Daniel Wagner <dwagner@suse.de>

---

 drivers/scsi/libfc/fc_exch.c |   16 ++++++++++++++--

 1 file changed, 14 insertions(+), 2 deletions(-)

--- a/drivers/scsi/libfc/fc_exch.c

+++ b/drivers/scsi/libfc/fc_exch.c

@@ -1631,8 +1631,13 @@ static void fc_exch_recv_seq_resp(struct

 		rc = fc_exch_done_locked(ep);

 		WARN_ON(fc_seq_exch(sp) != ep);

 		spin_unlock_bh(&ep->ex_lock);

-		if (!rc)

+		if (!rc) {

 			fc_exch_delete(ep);

+		} else {

+			FC_EXCH_DBG(ep, "ep is completed already,"

+					"hence skip calling the resp\n");

+			goto skip_resp;

+		}

 	}

 	/*

@@ -1651,6 +1656,7 @@ static void fc_exch_recv_seq_resp(struct

 	if (!fc_invoke_resp(ep, sp, fp))

 		fc_frame_free(fp);

+skip_resp:

 	fc_exch_release(ep);

 	return;

 rel:

@@ -1907,10 +1913,16 @@ static void fc_exch_reset(struct fc_exch

 	fc_exch_hold(ep);

-	if (!rc)

+	if (!rc) {

 		fc_exch_delete(ep);

+	} else {

+		FC_EXCH_DBG(ep, "ep is completed already,"

+				"hence skip calling the resp\n");

+		goto skip_resp;

+	}

 	fc_invoke_resp(ep, sp, ERR_PTR(-FC_EX_CLOSED));

+skip_resp:

 	fc_seq_set_resp(sp, NULL, ep->arg);

 	fc_exch_release(ep);

 }