s390/qeth: fix IPA command submission race
authorJulian Wiedmann <jwi@linux.vnet.ibm.com>
Tue, 27 Feb 2018 17:58:17 +0000 (18:58 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 11 Mar 2018 15:21:34 +0000 (16:21 +0100)
commitf3d26ce9ce34c5d34a23db6ecd00e23dec82febc
tree4d686f62d5832201b342414db9332ddc2dc261a2
parent058db71dd8d68973e3add8b5a355036ddc13b460
s390/qeth: fix IPA command submission race

[ Upstream commit d22ffb5a712f9211ffd104c38fc17cbfb1b5e2b0 ]

If multiple IPA commands are build & sent out concurrently,
fill_ipacmd_header() may assign a seqno value to a command that's
different from what send_control_data() later assigns to this command's
reply.
This is due to other commands passing through send_control_data(),
and incrementing card->seqno.ipa along the way.

So one IPA command has no reply that's waiting for its seqno, while some
other IPA command has multiple reply objects waiting for it.
Only one of those waiting replies wins, and the other(s) times out and
triggers a recovery via send_ipa_cmd().

Fix this by making sure that the same seqno value is assigned to
a command and its reply object.
Do so immediately before submitting the command & while holding the
irq_pending "lock", to produce nicely ascending seqnos.

As a side effect, *all* IPA commands now use a reply object that's
waiting for its actual seqno. Previously, early IPA commands that were
submitted while the card was still DOWN used the "catch-all" IDX seqno.

Signed-off-by: Julian Wiedmann <jwi@linux.vnet.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/s390/net/qeth_core_main.c