| Message ID | 20250313014728.105849-1-kanie@linux.alibaba.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 1909b643034ef741af9f24a57ab735440c4b5d1a |
| Headers | show |
| Series | scsi: target: tcm_loop: fix wrong abort tag | expand |
Gently ping... Hi Martin, this is a serious issue I think, cloud you plz take a look? Best Regards, Guixin Liu 在 2025/3/13 09:47, Guixin Liu 写道: > When the tcm_loop_nr_hw_queues is set to a value greater than 1, the > tags of requests in the block layer are no longer unique. This may lead > to erroneous aborting of commands with the same tag. The issue can be > resolved by using blk_mq_unique_tag to generate globally unique > identifiers by combining the hardware queue index and per-queue tags. > > Fixes: 6375f8908255 ("tcm_loop: Fixup tag handling") > Signed-off-by: Guixin Liu <kanie@linux.alibaba.com> > --- > drivers/target/loopback/tcm_loop.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > > diff --git a/drivers/target/loopback/tcm_loop.c b/drivers/target/loopback/tcm_loop.c > index 761c511aea07..c7b7da629741 100644 > --- a/drivers/target/loopback/tcm_loop.c > +++ b/drivers/target/loopback/tcm_loop.c > @@ -176,7 +176,7 @@ static int tcm_loop_queuecommand(struct Scsi_Host *sh, struct scsi_cmnd *sc) > > memset(tl_cmd, 0, sizeof(*tl_cmd)); > tl_cmd->sc = sc; > - tl_cmd->sc_cmd_tag = scsi_cmd_to_rq(sc)->tag; > + tl_cmd->sc_cmd_tag = blk_mq_unique_tag(scsi_cmd_to_rq(sc)); > > tcm_loop_target_queue_cmd(tl_cmd); > return 0; > @@ -242,7 +242,8 @@ static int tcm_loop_abort_task(struct scsi_cmnd *sc) > tl_hba = *(struct tcm_loop_hba **)shost_priv(sc->device->host); > tl_tpg = &tl_hba->tl_hba_tpgs[sc->device->id]; > ret = tcm_loop_issue_tmr(tl_tpg, sc->device->lun, > - scsi_cmd_to_rq(sc)->tag, TMR_ABORT_TASK); > + blk_mq_unique_tag(scsi_cmd_to_rq(sc)), > + TMR_ABORT_TASK); > return (ret == TMR_FUNCTION_COMPLETE) ? SUCCESS : FAILED; > } >
Guixin, > When the tcm_loop_nr_hw_queues is set to a value greater than 1, the > tags of requests in the block layer are no longer unique. This may > lead to erroneous aborting of commands with the same tag. The issue > can be resolved by using blk_mq_unique_tag to generate globally unique > identifiers by combining the hardware queue index and per-queue tags. Applied to 6.15/scsi-staging, thanks!
On Thu, 13 Mar 2025 09:47:27 +0800, Guixin Liu wrote: > When the tcm_loop_nr_hw_queues is set to a value greater than 1, the > tags of requests in the block layer are no longer unique. This may lead > to erroneous aborting of commands with the same tag. The issue can be > resolved by using blk_mq_unique_tag to generate globally unique > identifiers by combining the hardware queue index and per-queue tags. > > > [...] Applied to 6.15/scsi-queue, thanks! [1/1] scsi: target: tcm_loop: fix wrong abort tag https://git.kernel.org/mkp/scsi/c/1909b643034e
diff --git a/drivers/target/loopback/tcm_loop.c b/drivers/target/loopback/tcm_loop.c index 761c511aea07..c7b7da629741 100644 --- a/drivers/target/loopback/tcm_loop.c +++ b/drivers/target/loopback/tcm_loop.c @@ -176,7 +176,7 @@ static int tcm_loop_queuecommand(struct Scsi_Host *sh, struct scsi_cmnd *sc) memset(tl_cmd, 0, sizeof(*tl_cmd)); tl_cmd->sc = sc; - tl_cmd->sc_cmd_tag = scsi_cmd_to_rq(sc)->tag; + tl_cmd->sc_cmd_tag = blk_mq_unique_tag(scsi_cmd_to_rq(sc)); tcm_loop_target_queue_cmd(tl_cmd); return 0; @@ -242,7 +242,8 @@ static int tcm_loop_abort_task(struct scsi_cmnd *sc) tl_hba = *(struct tcm_loop_hba **)shost_priv(sc->device->host); tl_tpg = &tl_hba->tl_hba_tpgs[sc->device->id]; ret = tcm_loop_issue_tmr(tl_tpg, sc->device->lun, - scsi_cmd_to_rq(sc)->tag, TMR_ABORT_TASK); + blk_mq_unique_tag(scsi_cmd_to_rq(sc)), + TMR_ABORT_TASK); return (ret == TMR_FUNCTION_COMPLETE) ? SUCCESS : FAILED; }
When the tcm_loop_nr_hw_queues is set to a value greater than 1, the tags of requests in the block layer are no longer unique. This may lead to erroneous aborting of commands with the same tag. The issue can be resolved by using blk_mq_unique_tag to generate globally unique identifiers by combining the hardware queue index and per-queue tags. Fixes: 6375f8908255 ("tcm_loop: Fixup tag handling") Signed-off-by: Guixin Liu <kanie@linux.alibaba.com> --- drivers/target/loopback/tcm_loop.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)