Commit 2a3a59e5 authored by Mike Christie's avatar Mike Christie Committed by James Bottomley
Browse files

[SCSI] Fix hang in starved list processing

Close possible infinite loop with interrupts off when devices are
added back to the starved list.

Fixes: http://bugzilla.kernel.org/show_bug.cgi?id=11898



Reported-by: <alex.shi@intel.com>
Signed-off-by: default avatarMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: default avatarJames Bottomley <James.Bottomley@HansenPartnership.com>
parent 9bf1a244
...@@ -567,15 +567,18 @@ static inline int scsi_host_is_busy(struct Scsi_Host *shost) ...@@ -567,15 +567,18 @@ static inline int scsi_host_is_busy(struct Scsi_Host *shost)
*/ */
static void scsi_run_queue(struct request_queue *q) static void scsi_run_queue(struct request_queue *q)
{ {
struct scsi_device *starved_head = NULL, *sdev = q->queuedata; struct scsi_device *sdev = q->queuedata;
struct Scsi_Host *shost = sdev->host; struct Scsi_Host *shost = sdev->host;
LIST_HEAD(starved_list);
unsigned long flags; unsigned long flags;
if (scsi_target(sdev)->single_lun) if (scsi_target(sdev)->single_lun)
scsi_single_lun_run(sdev); scsi_single_lun_run(sdev);
spin_lock_irqsave(shost->host_lock, flags); spin_lock_irqsave(shost->host_lock, flags);
while (!list_empty(&shost->starved_list) && !scsi_host_is_busy(shost)) { list_splice_init(&shost->starved_list, &starved_list);
while (!list_empty(&starved_list)) {
int flagset; int flagset;
/* /*
...@@ -588,24 +591,18 @@ static void scsi_run_queue(struct request_queue *q) ...@@ -588,24 +591,18 @@ static void scsi_run_queue(struct request_queue *q)
* scsi_request_fn must get the host_lock before checking * scsi_request_fn must get the host_lock before checking
* or modifying starved_list or starved_entry. * or modifying starved_list or starved_entry.
*/ */
sdev = list_entry(shost->starved_list.next, if (scsi_host_is_busy(shost))
struct scsi_device, starved_entry);
/*
* The *queue_ready functions can add a device back onto the
* starved list's tail, so we must check for a infinite loop.
*/
if (sdev == starved_head)
break; break;
if (!starved_head)
starved_head = sdev;
sdev = list_entry(starved_list.next,
struct scsi_device, starved_entry);
list_del_init(&sdev->starved_entry);
if (scsi_target_is_busy(scsi_target(sdev))) { if (scsi_target_is_busy(scsi_target(sdev))) {
list_move_tail(&sdev->starved_entry, list_move_tail(&sdev->starved_entry,
&shost->starved_list); &shost->starved_list);
continue; continue;
} }
list_del_init(&sdev->starved_entry);
spin_unlock(shost->host_lock); spin_unlock(shost->host_lock);
spin_lock(sdev->request_queue->queue_lock); spin_lock(sdev->request_queue->queue_lock);
...@@ -621,6 +618,8 @@ static void scsi_run_queue(struct request_queue *q) ...@@ -621,6 +618,8 @@ static void scsi_run_queue(struct request_queue *q)
spin_lock(shost->host_lock); spin_lock(shost->host_lock);
} }
/* put any unprocessed entries back */
list_splice(&starved_list, &shost->starved_list);
spin_unlock_irqrestore(shost->host_lock, flags); spin_unlock_irqrestore(shost->host_lock, flags);
blk_run_queue(q); blk_run_queue(q);
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment