diff options
author | Jayamohan Kallickal <jayamohank@gmail.com> | 2013-09-28 18:35:39 -0400 |
---|---|---|
committer | James Bottomley <JBottomley@Parallels.com> | 2013-10-25 04:58:04 -0400 |
commit | e074d20f9bce54f64dcb43eb2772fde4a4d68171 (patch) | |
tree | d7777d244b9c1980c7e9526d8c41325acea39e17 /drivers/scsi/be2iscsi | |
parent | 15a90fe05c91d15ac46b68e3644e5f9f1bb51917 (diff) |
[SCSI] be2iscsi: Fix the MCCQ count leakage
When MBX CMD is posted in MCCQ and if command times out,during
mccq resource cleanup for the timed out command mccq->count
was not decremented. The led to BUG_ON being hit.
Signed-off-by: John Soni Jose <sony.john-n@emulex.com>
Signed-off-by: Jayamohan Kallickal <jayamohan.kallickal@emulex.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Diffstat (limited to 'drivers/scsi/be2iscsi')
-rw-r--r-- | drivers/scsi/be2iscsi/be_cmds.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/drivers/scsi/be2iscsi/be_cmds.c b/drivers/scsi/be2iscsi/be_cmds.c index bb70dcb493c6..f7788e59c3f2 100644 --- a/drivers/scsi/be2iscsi/be_cmds.c +++ b/drivers/scsi/be2iscsi/be_cmds.c | |||
@@ -174,6 +174,10 @@ int beiscsi_mccq_compl(struct beiscsi_hba *phba, | |||
174 | BEISCSI_LOG_CONFIG, | 174 | BEISCSI_LOG_CONFIG, |
175 | "BC_%d : MBX Cmd Completion timed out\n"); | 175 | "BC_%d : MBX Cmd Completion timed out\n"); |
176 | rc = -EAGAIN; | 176 | rc = -EAGAIN; |
177 | |||
178 | /* decrement the mccq used count */ | ||
179 | atomic_dec(&phba->ctrl.mcc_obj.q.used); | ||
180 | |||
177 | goto release_mcc_tag; | 181 | goto release_mcc_tag; |
178 | } else | 182 | } else |
179 | rc = 0; | 183 | rc = 0; |
@@ -699,7 +703,7 @@ struct be_mcc_wrb *wrb_from_mccq(struct beiscsi_hba *phba) | |||
699 | struct be_queue_info *mccq = &phba->ctrl.mcc_obj.q; | 703 | struct be_queue_info *mccq = &phba->ctrl.mcc_obj.q; |
700 | struct be_mcc_wrb *wrb; | 704 | struct be_mcc_wrb *wrb; |
701 | 705 | ||
702 | BUG_ON(atomic_read(&mccq->used) >= mccq->len); | 706 | WARN_ON(atomic_read(&mccq->used) >= mccq->len); |
703 | wrb = queue_head_node(mccq); | 707 | wrb = queue_head_node(mccq); |
704 | memset(wrb, 0, sizeof(*wrb)); | 708 | memset(wrb, 0, sizeof(*wrb)); |
705 | wrb->tag0 = (mccq->head & 0x000000FF) << 16; | 709 | wrb->tag0 = (mccq->head & 0x000000FF) << 16; |