[SCSI] aacraid: Improved error handling

Received from Mark Salyzyn,

This set of fixes improve error handling stability of the driver. A popular
manifestation of the problems is an NULL pointer reference in the interrupt
handler when referencing portions of the scsi command context, or in the
scsi_done handling when an offlined device is referenced.

The aacraid driver currently does not get notification of orphaned command
completions due to devices going offline. The driver also fails to handle the
commands that are finished by the error handler, and thus can complete again
later at the hands of the adapter causing situations of completion of an
invalid scsi command context. Test Unit Ready calls abort assuming that the
abort was successful, but are not, and thus when the interrupt from the adapter
occurs, they reference invalid command contexts. We add in a TIMED_OUT flag to
inform the aacraid FIB context that the interrupt service should merely release
the driver resources and not complete the command up. We take advantage of this
with the abort handler as well for select abortable commands. And we detect and
react if a command that can not be aborted is currently still outstanding to
the controller when reissued by the retry mechanism.

Signed-off-by: Mark Haverkamp <markh@linux-foundation.org>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

1 files changed, 13 insertions, 11 deletions

diff --git a/drivers/scsi/aacraid/dpcsup.c b/drivers/scsi/aacraid/dpcsup.c
index 26f4d563d959..4e53f9db1b2c 100644
--- a/drivers/scsi/aacraid/dpcsup.c
+++ b/drivers/scsi/aacraid/dpcsup.c
@@ -5,7 +5,7 @@
  * based on the old aacraid driver that is..
  * Adaptec aacraid device driver for Linux.
  *
- * Copyright (c) 2000 Adaptec, Inc. (aacraid@adaptec.com)
+ * Copyright (c) 2000-2007 Adaptec, Inc. (aacraid@adaptec.com)
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -84,11 +84,13 @@ unsigned int aac_response_normal(struct aac_queue * q)
                  *      continue. The caller has already been notified that
                  *      the fib timed out.
                  */
-                if (!(fib->flags & FIB_CONTEXT_FLAG_TIMED_OUT))
-                        dev->queues->queue[AdapNormCmdQueue].numpending--;
-                else {
-                        printk(KERN_WARNING "aacraid: FIB timeout (%x).\n", fib->flags);
-                        printk(KERN_DEBUG"aacraid: hwfib=%p fib index=%i fib=%p\n",hwfib, hwfib->header.SenderData,fib);
+                dev->queues->queue[AdapNormCmdQueue].numpending--;
+
+                if (unlikely(fib->flags & FIB_CONTEXT_FLAG_TIMED_OUT)) {
+                        spin_unlock_irqrestore(q->lock, flags);
+                        aac_fib_complete(fib);
+                        aac_fib_free(fib);
+                        spin_lock_irqsave(q->lock, flags);
                         continue;
                 }
                 spin_unlock_irqrestore(q->lock, flags);
@@ -281,14 +283,14 @@ unsigned int aac_intr_normal(struct aac_dev * dev, u32 Index)
                  *      continue. The caller has already been notified that
                  *      the fib timed out.
                  */
-                if ((fib->flags & FIB_CONTEXT_FLAG_TIMED_OUT)) {
-                        printk(KERN_WARNING "aacraid: FIB timeout (%x).\n", fib->flags);
-                        printk(KERN_DEBUG"aacraid: hwfib=%p index=%i fib=%p\n",hwfib, hwfib->header.SenderData,fib);
+                dev->queues->queue[AdapNormCmdQueue].numpending--;
+
+                if (unlikely(fib->flags & FIB_CONTEXT_FLAG_TIMED_OUT)) {
+                        aac_fib_complete(fib);
+                        aac_fib_free(fib);
                         return 0;
                 }
 
-                dev->queues->queue[AdapNormCmdQueue].numpending--;
-
                 if (fast) {
                         /*
                          *      Doctor the fib