diff options
author | Avri Altman <avri.altman@wdc.com> | 2021-08-08 12:00:23 +0300 |
---|---|---|
committer | Martin K. Petersen <martin.petersen@oracle.com> | 2021-08-11 22:25:36 -0400 |
commit | 22aede9f48b6766fb67441610120db9b04adf109 (patch) | |
tree | 8c6f98a4cf0c7d081b0a3d72f692a2998f32f2b8 /drivers/scsi/ufs/ufshpb.c | |
parent | 07106f86ae13d9197bfd38c2d47743304b14099e (diff) | |
download | linux-22aede9f48b6766fb67441610120db9b04adf109.tar.bz2 |
scsi: ufs: ufshpb: Verify that 'num_inflight_map_req' is non-negative
'num_inflight_map_req' should not be negative. It is incremented and
decremented without any protection, allowing it theoretically to be
negative, should some weird unbalanced count occur.
Verify that the those calls are properly serialized.
Link: https://lore.kernel.org/r/20210808090024.21721-4-avri.altman@wdc.com
Fixes: 33845a2d844b (scsi: ufs: ufshpb: Limit the number of in-flight map requests)
Signed-off-by: Avri Altman <avri.altman@wdc.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Diffstat (limited to 'drivers/scsi/ufs/ufshpb.c')
-rw-r--r-- | drivers/scsi/ufs/ufshpb.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/drivers/scsi/ufs/ufshpb.c b/drivers/scsi/ufs/ufshpb.c index 8e92c61ed9d4..cd48367f94cc 100644 --- a/drivers/scsi/ufs/ufshpb.c +++ b/drivers/scsi/ufs/ufshpb.c @@ -756,6 +756,7 @@ static struct ufshpb_req *ufshpb_get_map_req(struct ufshpb_lu *hpb, { struct ufshpb_req *map_req; struct bio *bio; + unsigned long flags; if (hpb->is_hcm && hpb->num_inflight_map_req >= hpb->params.inflight_map_req) { @@ -780,7 +781,10 @@ static struct ufshpb_req *ufshpb_get_map_req(struct ufshpb_lu *hpb, map_req->rb.srgn_idx = srgn->srgn_idx; map_req->rb.mctx = srgn->mctx; + + spin_lock_irqsave(&hpb->param_lock, flags); hpb->num_inflight_map_req++; + spin_unlock_irqrestore(&hpb->param_lock, flags); return map_req; } @@ -788,9 +792,14 @@ static struct ufshpb_req *ufshpb_get_map_req(struct ufshpb_lu *hpb, static void ufshpb_put_map_req(struct ufshpb_lu *hpb, struct ufshpb_req *map_req) { + unsigned long flags; + bio_put(map_req->bio); ufshpb_put_req(hpb, map_req); + + spin_lock_irqsave(&hpb->param_lock, flags); hpb->num_inflight_map_req--; + spin_unlock_irqrestore(&hpb->param_lock, flags); } static int ufshpb_clear_dirty_bitmap(struct ufshpb_lu *hpb, @@ -2387,6 +2396,7 @@ static int ufshpb_lu_hpb_init(struct ufs_hba *hba, struct ufshpb_lu *hpb) spin_lock_init(&hpb->rgn_state_lock); spin_lock_init(&hpb->rsp_list_lock); + spin_lock_init(&hpb->param_lock); INIT_LIST_HEAD(&hpb->lru_info.lh_lru_rgn); INIT_LIST_HEAD(&hpb->lh_act_srgn); |