From 9bfb9931eefe9839c4b5d9ad43feab44e55dcfd7 Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Sun, 25 Aug 2019 02:04:12 +0000
Subject: [PATCH] qla2x00t-32gbit: Really fix qla2xxx_eh_abort()

I'm not sure how this happened but the patch that was intended to fix abort
handling was incomplete. This patch fixes that patch as follows:

 - If aborting the SCSI command failed, wait until the SCSI command
   completes.

 - Return SUCCESS instead of FAILED if an abort attempt races with SCSI
   command completion.

 - Since qla2xxx_eh_abort() increments the sp reference count by calling
   sp_get(), decrement the sp reference count before returning.

Fixes: 1b4ae64d8da6 ("qla2xxx: Fix a race condition between aborting and completing a SCSI command")

[ commit 8dd9593cc07ad7d999bef81b06789ef873a94881 upstream ]


git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@8538 d57e44dd-8a1f-0410-8b47-8ef2f437770f
---
 qla2x00t-32gbit/qla_os.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/qla2x00t-32gbit/qla_os.c b/qla2x00t-32gbit/qla_os.c
index 0736e5dbf..b8f014f59 100644
--- a/qla2x00t-32gbit/qla_os.c
+++ b/qla2x00t-32gbit/qla_os.c
@@ -1355,7 +1355,6 @@ qla2xxx_eh_abort(struct scsi_cmnd *cmd)
 	    "Aborting from RISC nexus=%ld:%d:%llu sp=%p cmd=%p handle=%x\n",
 	    vha->host_no, id, lun, sp, cmd, sp->handle);
 
-	ret = SUCCESS;
 	rval = ha->isp_ops->abort_command(sp);
 	ql_dbg(ql_dbg_taskm, vha, 0x8003,
 	       "Abort command mbx cmd=%p, rval=%x.\n", cmd, rval);
@@ -1367,9 +1366,9 @@ qla2xxx_eh_abort(struct scsi_cmnd *cmd)
 		 * won't report a completion.
 		 */
 		sp->done(sp, DID_ABORT << 16);
+		ret = SUCCESS;
 		break;
-	case QLA_FUNCTION_PARAMETER_ERROR:
-	default: {
+	case QLA_FUNCTION_PARAMETER_ERROR: {
 		/* Wait for the command completion. */
 		uint32_t ratov = ha->r_a_tov/10;
 		uint32_t ratov_j = msecs_to_jiffies(4 * ratov * 1000);
@@ -1380,10 +1379,18 @@ qla2xxx_eh_abort(struct scsi_cmnd *cmd)
 			    "%s: Abort wait timer (4 * R_A_TOV[%d]) expired\n",
 			    __func__, ha->r_a_tov);
 			ret = FAILED;
-			break;
+		} else {
+			ret = SUCCESS;
 		}
 		break;
 	}
+	default:
+		/*
+		 * Either abort failed or abort and completion raced. Let
+		 * the SCSI core retry the abort in the former case.
+		 */
+		ret = FAILED;
+		break;
 	}
 
 	sp->comp = NULL;