Hi,

Using a static bug finder (EBA - https://github.com/models-team/eba) I
may have found a double spin_lock_irqsave bug in Linux 4.8's
drivers/scsi/megaraid/megaraid_mbox.c.

The forward trace is as follows:

1. Starting in function `megaraid_reset_handler' at 2571;
   (see 
https://github.com/torvalds/linux/blob/v4.8-rc8/drivers/scsi/megaraid/megaraid_mbox.c#L2571)
2. take `&adapter->pend_list_lock' for the first time at 2602:

       spin_lock_irqsave(PENDING_LIST_LOCK(adapter), flags);

3. enter the `list_for_each_entry_safe' loop at 2603;
4. if (scb->sno >= MBOX_MAX_SCSI_CMDS) evaluates to `true' at 2606;
5. call `megaraid_mbox_mm_done' passing `adapter' at 2616 (go to line 3752);
   (see 
https://github.com/torvalds/linux/blob/v4.8-rc8/drivers/scsi/megaraid/megaraid_mbox.c#L3752)
6. if (raw_mbox[0] == FC_DEL_LOGDRV && raw_mbox[2] == OP_DEL_LOGDRV)
evaluates to `true' at 3778;
7. call `megaraid_mbox_runpendq' at 3782 (go to line 1886);
   (see 
https://github.com/torvalds/linux/blob/v4.8-rc8/drivers/scsi/megaraid/megaraid_mbox.c#L1886)
8. take `&adapter->pend_list_lock' for the second time at 1892:

       spin_lock_irqsave(PENDING_LIST_LOCK(adapter), flags);

If that's a bug then I am willing to help with a patch.

Thank you for your time,

-- iago
--
To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to