1 files changed, 11 insertions, 11 deletions

diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index dd338a8cd275..16eef068e9e9 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -297,19 +297,19 @@ enum blk_eh_timer_return scsi_times_out(struct request *req)
 
         if (rtn == BLK_EH_DONE) {
                 /*
-                 * For blk-mq, we must set the request state to complete now
-                 * before sending the request to the scsi error handler. This
-                 * will prevent a use-after-free in the event the LLD manages
-                 * to complete the request before the error handler finishes
-                 * processing this timed out request.
+                 * Set the command to complete first in order to prevent a real
+                 * completion from releasing the command while error handling
+                 * is using it. If the command was already completed, then the
+                 * lower level driver beat the timeout handler, and it is safe
+                 * to return without escalating error recovery.
                  *
-                 * If the request was already completed, then the LLD beat the
-                 * time out handler from transferring the request to the scsi
-                 * error handler. In that case we can return immediately as no
-                 * further action is required.
+                 * If timeout handling lost the race to a real completion, the
+                 * block layer may ignore that due to a fake timeout injection,
+                 * so return RESET_TIMER to allow error handling another shot
+                 * at this command.
                  */
-                if (!blk_mq_mark_complete(req))
-                        return rtn;
+                if (test_and_set_bit(SCMD_STATE_COMPLETE, &scmd->state))
+                        return BLK_EH_RESET_TIMER;
                 if (scsi_abort_command(scmd) != SUCCESS) {
                         set_host_byte(scmd, DID_TIME_OUT);
                         scsi_eh_scmd_add(scmd);