ide: ensure atapi sense request aren't preempted

There's an issue with how sense requests are handled in IDE. If ide-cd
encounters an error, it queues a sense request. With how IDE request
handling is done, this is the next request we need to handle. But it's
impossible to guarantee this, as another request could come in between
the sense being queued, and ->queue_rq() being run and handling it. If
that request ALSO fails, then we attempt to doubly queue the single
sense request we have.

Since we only support one active request at the time, defer request
processing when a sense request is queued.

Fixes: 600335205b8d "ide: convert to blk-mq"
Reported-by: He Zhe <zhe.he@windriver.com>
Tested-by: He Zhe <zhe.he@windriver.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

1 files changed, 31 insertions, 30 deletions

diff --git a/drivers/ide/ide-io.c b/drivers/ide/ide-io.c
index 8445b484ae69..b137f27a34d5 100644
--- a/drivers/ide/ide-io.c
+++ b/drivers/ide/ide-io.c
@@ -68,8 +68,10 @@ int ide_end_rq(ide_drive_t *drive, struct request *rq, blk_status_t error,
         }
 
         if (!blk_update_request(rq, error, nr_bytes)) {
-                if (rq == drive->sense_rq)
+                if (rq == drive->sense_rq) {
                         drive->sense_rq = NULL;
+                        drive->sense_rq_active = false;
+                }
 
                 __blk_mq_end_request(rq, error);
                 return 0;
@@ -451,16 +453,11 @@ void ide_requeue_and_plug(ide_drive_t *drive, struct request *rq)
                 blk_mq_delay_run_hw_queue(q->queue_hw_ctx[0], 3);
 }
 
-/*
- * Issue a new request to a device.
- */
-blk_status_t ide_queue_rq(struct blk_mq_hw_ctx *hctx,
-                          const struct blk_mq_queue_data *bd)
+blk_status_t ide_issue_rq(ide_drive_t *drive, struct request *rq,
+                          bool local_requeue)
 {
-        ide_drive_t     *drive = hctx->queue->queuedata;
-        ide_hwif_t      *hwif = drive->hwif;
+        ide_hwif_t *hwif = drive->hwif;
         struct ide_host *host = hwif->host;
-        struct request  *rq = bd->rq;
         ide_startstop_t startstop;
 
         if (!blk_rq_is_passthrough(rq) && !(rq->rq_flags & RQF_DONTPREP)) {
@@ -474,8 +471,6 @@ blk_status_t ide_queue_rq(struct blk_mq_hw_ctx *hctx,
         if (ide_lock_host(host, hwif))
                 return BLK_STS_DEV_RESOURCE;
 
-        blk_mq_start_request(rq);
-
         spin_lock_irq(&hwif->lock);
 
         if (!ide_lock_port(hwif)) {
@@ -511,18 +506,6 @@ repeat:
                 drive->dev_flags &= ~(IDE_DFLAG_SLEEPING | IDE_DFLAG_PARKED);
 
                 /*
-                 * we know that the queue isn't empty, but this can happen
-                 * if ->prep_rq() decides to kill a request
-                 */
-                if (!rq) {
-                        rq = bd->rq;
-                        if (!rq) {
-                                ide_unlock_port(hwif);
-                                goto out;
-                        }
-                }
-
-                /*
                  * Sanity: don't accept a request that isn't a PM request
                  * if we are currently power managed. This is very important as
                  * blk_stop_queue() doesn't prevent the blk_fetch_request()
@@ -560,9 +543,12 @@ repeat:
                 }
         } else {
 plug_device:
+                if (local_requeue)
+                        list_add(&rq->queuelist, &drive->rq_list);
                 spin_unlock_irq(&hwif->lock);
                 ide_unlock_host(host);
-                ide_requeue_and_plug(drive, rq);
+                if (!local_requeue)
+                        ide_requeue_and_plug(drive, rq);
                 return BLK_STS_OK;
         }
 
@@ -573,6 +559,26 @@ out:
         return BLK_STS_OK;
 }
 
+/*
+ * Issue a new request to a device.
+ */
+blk_status_t ide_queue_rq(struct blk_mq_hw_ctx *hctx,
+                          const struct blk_mq_queue_data *bd)
+{
+        ide_drive_t *drive = hctx->queue->queuedata;
+        ide_hwif_t *hwif = drive->hwif;
+
+        spin_lock_irq(&hwif->lock);
+        if (drive->sense_rq_active) {
+                spin_unlock_irq(&hwif->lock);
+                return BLK_STS_DEV_RESOURCE;
+        }
+        spin_unlock_irq(&hwif->lock);
+
+        blk_mq_start_request(bd->rq);
+        return ide_issue_rq(drive, bd->rq, false);
+}
+
 static int drive_is_ready(ide_drive_t *drive)
 {
         ide_hwif_t *hwif = drive->hwif;
@@ -893,13 +899,8 @@ EXPORT_SYMBOL_GPL(ide_pad_transfer);
 
 void ide_insert_request_head(ide_drive_t *drive, struct request *rq)
 {
-        ide_hwif_t *hwif = drive->hwif;
-        unsigned long flags;
-
-        spin_lock_irqsave(&hwif->lock, flags);
+        drive->sense_rq_active = true;
         list_add_tail(&rq->queuelist, &drive->rq_list);
-        spin_unlock_irqrestore(&hwif->lock, flags);
-
         kblockd_schedule_work(&drive->rq_work);
 }
 EXPORT_SYMBOL_GPL(ide_insert_request_head);