linux/drivers/ata
David Jeffery 1dd95dfd83 libata: prevent HSM state change race between ISR and PIO
commit ce75145267 upstream.

It is possible for ata_sff_flush_pio_task() to set ap->hsm_task_state to
HSM_ST_IDLE in between the time __ata_sff_port_intr() checks for HSM_ST_IDLE
and before it calls ata_sff_hsm_move() causing ata_sff_hsm_move() to BUG().

This problem is hard to reproduce making this patch hard to verify, but this
fix will prevent the race.

I have not been able to reproduce the problem, but here is a crash dump from
a 2.6.32 kernel.

On examining the ata port's state, its hsm_task_state field has a value of HSM_ST_IDLE:

crash> struct ata_port.hsm_task_state ffff881c1121c000
  hsm_task_state = 0

Normally, this should not be possible as ata_sff_hsm_move() was called from ata_sff_host_intr(),
which checks hsm_task_state and won't call ata_sff_hsm_move() if it has a HSM_ST_IDLE value.

PID: 11053  TASK: ffff8816e846cae0  CPU: 0   COMMAND: "sshd"
 #0 [ffff88008ba03960] machine_kexec at ffffffff81038f3b
 #1 [ffff88008ba039c0] crash_kexec at ffffffff810c5d92
 #2 [ffff88008ba03a90] oops_end at ffffffff8152b510
 #3 [ffff88008ba03ac0] die at ffffffff81010e0b
 #4 [ffff88008ba03af0] do_trap at ffffffff8152ad74
 #5 [ffff88008ba03b50] do_invalid_op at ffffffff8100cf95
 #6 [ffff88008ba03bf0] invalid_op at ffffffff8100bf9b
    [exception RIP: ata_sff_hsm_move+317]
    RIP: ffffffff813a77ad  RSP: ffff88008ba03ca0  RFLAGS: 00010097
    RAX: 0000000000000000  RBX: ffff881c1121dc60  RCX: 0000000000000000
    RDX: ffff881c1121dd10  RSI: ffff881c1121dc60  RDI: ffff881c1121c000
    RBP: ffff88008ba03d00   R8: 0000000000000000   R9: 000000000000002e
    R10: 000000000001003f  R11: 000000000000009b  R12: ffff881c1121c000
    R13: 0000000000000000  R14: 0000000000000050  R15: ffff881c1121dd78
    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
 #7 [ffff88008ba03d08] ata_sff_host_intr at ffffffff813a7fbd
 #8 [ffff88008ba03d38] ata_sff_interrupt at ffffffff813a821e
 #9 [ffff88008ba03d78] handle_IRQ_event at ffffffff810e6ec0
2015-01-29 17:40:55 -08:00
..
acard-ahci.c libata: update "Maintained by:" tags 2013-05-14 11:13:04 -07:00
ahci_platform.c Drivers: ata: remove __dev* attributes. 2013-01-03 15:57:03 -08:00
ahci.c ahci: disable MSI on SAMSUNG 0xa800 SSD 2014-12-16 09:09:42 -08:00
ahci.h libata: update "Maintained by:" tags 2013-05-14 11:13:04 -07:00
ata_generic.c ata: use module_pci_driver 2012-07-25 15:12:11 -04:00
ata_piix.c ata_piix: Add Device IDs for Intel 9 Series PCH 2014-10-05 14:54:13 -07:00
Kconfig libata: make it clear that sata_inic162x is experimental 2013-08-04 16:50:55 +08:00
libahci.c ahci: disabled FBS prior to issuing software reset 2013-12-04 10:56:13 -08:00
libata-acpi.c libata-acpi: add back ACPI based hotplug functionality 2013-06-25 00:51:33 +02:00
libata-core.c libata: introduce ata_host->n_tags to avoid oops on SAS controllers 2014-07-31 12:53:49 -07:00
libata-eh.c libata: make ata_eh_qc_retry() bump scmd->allowed on bogus failures 2013-11-13 12:05:31 +09:00
libata-pmp.c ata: enable quirk from jmicron JMB350 for JMB394 2014-03-06 21:30:08 -08:00
libata-scsi.c libata: disable LPM for some WD SATA-I devices 2014-02-06 11:08:16 -08:00
libata-sff.c libata: prevent HSM state change race between ISR and PIO 2015-01-29 17:40:55 -08:00
libata-transport.c libata: Fix display of sata speed 2013-12-04 10:55:51 -08:00
libata-transport.h [libata] Add ATA transport class 2010-10-21 20:21:03 -04:00
libata-zpodd.c libata-zpodd: must use ata_tf_init() 2013-07-25 14:07:27 -07:00
libata.h libata-acpi: add back ACPI based hotplug functionality 2013-06-25 00:51:33 +02:00
Makefile libata: add R-Car SATA driver 2013-02-20 17:10:53 -05:00
pata_acpi.c ata: use module_pci_driver 2012-07-25 15:12:11 -04:00
pata_ali.c pata_ali: fix "Satelite" typo 2011-10-14 13:10:42 -04:00
pata_amd.c ata: use module_pci_driver 2012-07-25 15:12:11 -04:00
pata_arasan_cf.c ata: arasan: remove the need for platform_data 2013-04-19 22:25:51 +02:00
pata_artop.c ata: use module_pci_driver 2012-07-25 15:12:11 -04:00
pata_at32.c pata_at32: use module_platform_driver_probe() 2013-04-03 19:52:10 -04:00
pata_at91.c pata_at91: fix ata_host_activate() failure handling 2014-06-07 13:25:29 -07:00
pata_atiixp.c pata_atiixp: override cable detection on MSI E350DM-E33 2012-08-17 13:26:51 -04:00
pata_atp867x.c ata: use module_pci_driver 2012-07-25 15:12:11 -04:00
pata_bf54x.c Drivers: ata: remove __dev* attributes. 2013-01-03 15:57:03 -08:00
pata_cmd64x.c ata: Convert dev_printk(KERN_<LEVEL> to dev_<level>( 2012-11-28 12:40:15 -05:00
pata_cmd640.c ata: use module_pci_driver 2012-07-25 15:12:11 -04:00
pata_cs5520.c Drivers: ata: remove __dev* attributes. 2013-01-03 15:57:03 -08:00
pata_cs5530.c ata: use module_pci_driver 2012-07-25 15:12:11 -04:00
pata_cs5535.c ata: use module_pci_driver 2012-07-25 15:12:11 -04:00
pata_cs5536.c pata_cs5536: add quirk for broken udma 2012-11-28 12:38:41 -05:00
pata_cypress.c ata: use module_pci_driver 2012-07-25 15:12:11 -04:00
pata_efar.c ata: use module_pci_driver 2012-07-25 15:12:11 -04:00
pata_ep93xx.c drivers/ata: don't check resource with devm_ioremap_resource 2013-05-12 15:19:46 +02:00
pata_hpt3x2n.c ata: use module_pci_driver 2012-07-25 15:12:11 -04:00
pata_hpt3x3.c ata: use module_pci_driver 2012-07-25 15:12:11 -04:00
pata_hpt37x.c ata: use module_pci_driver 2012-07-25 15:12:11 -04:00
pata_hpt366.c ata: use module_pci_driver 2012-07-25 15:12:11 -04:00
pata_icside.c Drivers: ata: remove __dev* attributes. 2013-01-03 15:57:03 -08:00
pata_imx.c pata_imx: add devicetree support 2013-04-11 19:38:00 -04:00
pata_isapnp.c [libata] Improve timeout handling 2009-03-24 22:52:39 -04:00
pata_it821x.c ata: use module_pci_driver 2012-07-25 15:12:11 -04:00
pata_it8213.c ata: use module_pci_driver 2012-07-25 15:12:11 -04:00
pata_ixp4xx_cf.c Drivers: ata: remove __dev* attributes. 2013-01-03 15:57:03 -08:00
pata_jmicron.c ata: use module_pci_driver 2012-07-25 15:12:11 -04:00
pata_legacy.c pata_legacy: bogus clock in opti82c46x_set_piomode() 2013-04-03 19:53:10 -04:00
pata_macio.c Drivers: ata: remove __dev* attributes. 2013-01-03 15:57:03 -08:00
pata_marvell.c ata: use module_pci_driver 2012-07-25 15:12:11 -04:00
pata_mpc52xx.c Merge remote-tracking branch 'agust/next' into next 2013-02-20 11:39:05 +11:00
pata_mpiix.c ata: use module_pci_driver 2012-07-25 15:12:11 -04:00
pata_netcell.c ata: use module_pci_driver 2012-07-25 15:12:11 -04:00
pata_ninja32.c ata: use module_pci_driver 2012-07-25 15:12:11 -04:00
pata_ns87410.c ata: use module_pci_driver 2012-07-25 15:12:11 -04:00
pata_ns87415.c ata: use module_pci_driver 2012-07-25 15:12:11 -04:00
pata_octeon_cf.c pata_octeon_cf: Use resource_size function 2013-04-03 19:53:30 -04:00
pata_of_platform.c Drivers: ata: remove __dev* attributes. 2013-01-03 15:57:03 -08:00
pata_oldpiix.c ata: use module_pci_driver 2012-07-25 15:12:11 -04:00
pata_opti.c ata: use module_pci_driver 2012-07-25 15:12:11 -04:00
pata_optidma.c ata: use module_pci_driver 2012-07-25 15:12:11 -04:00
pata_palmld.c Drivers: ata: remove __dev* attributes. 2013-01-03 15:57:03 -08:00
pata_pcmcia.c drivers/ata: use module_pcmcia_driver() in pcmcia drivers 2013-03-15 12:26:03 -07:00
pata_pdc202xx_old.c ata: use module_pci_driver 2012-07-25 15:12:11 -04:00
pata_pdc2027x.c pata_pdc2027x: Fix compiler warning 2013-04-12 15:24:12 +02:00
pata_piccolo.c ata: use module_pci_driver 2012-07-25 15:12:11 -04:00
pata_platform.c Drivers: ata: remove __dev* attributes. 2013-01-03 15:57:03 -08:00
pata_pxa.c Drivers: ata: remove __dev* attributes. 2013-01-03 15:57:03 -08:00
pata_radisys.c ata: use module_pci_driver 2012-07-25 15:12:11 -04:00
pata_rb532_cf.c Drivers: ata: remove __dev* attributes. 2013-01-03 15:57:03 -08:00
pata_rdc.c Drivers: ata: remove __dev* attributes. 2013-01-03 15:57:03 -08:00
pata_rz1000.c ata: use module_pci_driver 2012-07-25 15:12:11 -04:00
pata_samsung_cf.c pata_samsung_cf: use module_platform_driver_probe() 2013-03-04 17:12:52 -05:00
pata_sc1200.c ata: use module_pci_driver 2012-07-25 15:12:11 -04:00
pata_scc.c pata_scc: propagate return value of scc_wait_after_reset 2014-10-05 14:54:07 -07:00
pata_sch.c Drivers: ata: remove __dev* attributes. 2013-01-03 15:57:03 -08:00
pata_serverworks.c pata_serverworks: disable 64-KB DMA transfers on Broadcom OSB4 IDE Controller 2014-11-14 08:47:53 -08:00
pata_sil680.c Drivers: ata: remove __dev* attributes. 2013-01-03 15:57:03 -08:00
pata_sis.c ata: use module_pci_driver 2012-07-25 15:12:11 -04:00
pata_sl82c105.c ata: use module_pci_driver 2012-07-25 15:12:11 -04:00
pata_triflex.c ata: use module_pci_driver 2012-07-25 15:12:11 -04:00
pata_via.c ata: use module_pci_driver 2012-07-25 15:12:11 -04:00
pdc_adma.c libata: update "Maintained by:" tags 2013-05-14 11:13:04 -07:00
sata_dwc_460ex.c sata_dwc_460ex: remove file exec bit (chmod 0755 -> 0644) 2012-12-14 09:43:39 -05:00
sata_fsl.c sata_fsl: fix error handling of irq_of_parse_and_map 2014-12-16 09:09:42 -08:00
sata_highbank.c sata_highbank: increase retry count but shorten duration for Calxeda controller 2013-07-25 14:07:28 -07:00
sata_inic162x.c libata: make it clear that sata_inic162x is experimental 2013-08-04 16:50:55 +08:00
sata_mv.c ata: sata_mv: fix disk hotplug for Armada 370/XP SoCs 2014-02-06 11:08:16 -08:00
sata_nv.c ata: use module_pci_driver 2012-07-25 15:12:11 -04:00
sata_promise.c libata: update "Maintained by:" tags 2013-05-14 11:13:04 -07:00
sata_promise.h libata annotations and fixes 2008-01-23 05:24:15 -05:00
sata_qstor.c ata: use module_pci_driver 2012-07-25 15:12:11 -04:00
sata_rcar.c sata_rcar: fix interrupt handling 2013-06-02 00:54:45 -07:00
sata_sil.c sata_sil: apply MOD15WRITE quirk to TOSHIBA MK2561GSYN 2014-03-06 21:30:09 -08:00
sata_sil24.c sata_sil24: remove unused variable from sata_sil24.c 2012-11-28 12:39:20 -05:00
sata_sis.c ata: use module_pci_driver 2012-07-25 15:12:11 -04:00
sata_svw.c sata_svw: switch to ->show_info() 2013-04-09 14:13:28 -04:00
sata_sx4.c libata: update "Maintained by:" tags 2013-05-14 11:13:04 -07:00
sata_uli.c ata: use module_pci_driver 2012-07-25 15:12:11 -04:00
sata_via.c libata: update "Maintained by:" tags 2013-05-14 11:13:04 -07:00
sata_vsc.c Drivers: ata: remove __dev* attributes. 2013-01-03 15:57:03 -08:00
sis.h