linux-kernel - [RFC 2/2] megaraid: replacing fusion->busy_mq_poll[*] with irq_context->in_used in megasas_blk_mq

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20260125121842.79839-3-pilgrimtao@gmail.com>
Date: Sun, 25 Jan 2026 20:18:42 +0800
From: chengkaitao <pilgrimtao@...il.com>
To: kashyap.desai@...adcom.com,
	sumit.saxena@...adcom.com,
	shivasharan.srikanteshwara@...adcom.com,
	chandrakanth.patil@...adcom.com,
	James.Bottomley@...senPartnership.com,
	martin.petersen@...cle.com
Cc: megaraidlinux.pdl@...adcom.com,
	linux-scsi@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Chengkaitao <chengkaitao@...inos.cn>
Subject: [RFC 2/2] megaraid: replacing fusion->busy_mq_poll[*] with irq_context->in_used in megasas_blk_mq_poll

From: Chengkaitao <chengkaitao@...inos.cn>

The following two types of kernel panics occur on the 4.19 kernel:
Call Trace:
complete_cmd_fusion+0x448/0x6a0 [megaraid_sas]
megasas_blk_mq_poll+0xa8/0x110 [megaraid_sas]
scsi_mq_poll+0x38/0x50
blk_mq_poll+0x198/0x2d8
blk_poll+0x60/0x70
swap_readpage+0x1b0/0x260
read_swap_cache_async+0x5c/0x78
swap_cluster_readahead+0x1e0/0x2b0
swapin_readahead+0x100/0x4c0
do_swap_page+0x244/0xb40
__handle_mm_fault+0x4b0/0x560
handle_mm_fault+0x114/0x280
do_page_fault+0x1f8/0x4c0
do_translation_fault+0xa8/0xbc
do_mem_abort+0x50/0xe0
el1_da+0x20/0x94

Call trace:
complete_cmd_fusion+0x448/0x6a0 [megaraid_sas]
megasas_isr_fusion+0x98/0xa8 [megaraid_sas]
__handle_irq_event_percpu+0x64/0x260
handle_irq_event_percpu+0x28/0x60
handle_irq_event+0x50/0xf8
handle_fasteoi_edge_irq+0x190/0x208
generic_handle_irq+0x3c/0x58
__handle_domain_irq+0x68/0xc0
gic_handle_irq+0x78/0x180
el1_irq+0xb8/0x140

Later, we applied commit 9650b453a3d4 ("block: ignore RWF_HIPRI hint
for sync dio"), and the issue disappeared. Although most of the mq-poll
paths have been removed upstream, io-uring related calls still remain.

We cannot completely rule out the possibility of [patch 1/2] causing
the issue. I still suspect a concurrency/race condition between
megasas_blk_mq_poll and megasas_isr_fusion. Although historical patch
commit logs mention that interrupts are disabled when polling is used,
I haven't found code evidence to confirm it.

Replacing fusion->busy_mq_poll[*] with irq_context->in_used serves two
purposes:
To handle synchronization issues between mq-poll and megasas_isr_fusion
To handle synchronization between mq-poll and megasas_reset_reply_desc

Note: This is a proposed patch for discussion only. It has not been
verified to resolve the issue. If you have alternative suggestions,
please join the discussion.

Signed-off-by: Chengkaitao <chengkaitao@...inos.cn>
---
 drivers/scsi/megaraid/megaraid_sas_fusion.c | 11 +++--------
 drivers/scsi/megaraid/megaraid_sas_fusion.h |  2 --
 2 files changed, 3 insertions(+), 10 deletions(-)

diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c
index 3d3480b19734..b647bec7115b 100644
--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
+++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
@@ -1871,9 +1871,6 @@ megasas_init_adapter_fusion(struct megasas_instance *instance)
 				MEGASAS_FUSION_IOCTL_CMDS);
 	sema_init(&instance->ioctl_sem, MEGASAS_FUSION_IOCTL_CMDS);
 
-	for (i = 0; i < MAX_MSIX_QUEUES_FUSION; i++)
-		atomic_set(&fusion->busy_mq_poll[i], 0);
-
 	if (megasas_alloc_ioc_init_frame(instance))
 		return 1;
 
@@ -3731,6 +3728,7 @@ int megasas_blk_mq_poll(struct Scsi_Host *shost, unsigned int queue_num)
 	struct megasas_instance *instance;
 	int num_entries = 0;
 	struct fusion_context *fusion;
+	struct megasas_irq_context *irq_context;
 
 	instance = (struct megasas_instance *)shost->hostdata;
 
@@ -3738,11 +3736,8 @@ int megasas_blk_mq_poll(struct Scsi_Host *shost, unsigned int queue_num)
 
 	queue_num = queue_num + instance->low_latency_index_start;
 
-	if (!atomic_add_unless(&fusion->busy_mq_poll[queue_num], 1, 1))
-		return 0;
-
-	num_entries = complete_cmd_fusion(instance, queue_num, NULL);
-	atomic_dec(&fusion->busy_mq_poll[queue_num]);
+	irq_context = &instance->irq_context[queue_num];
+	num_entries = complete_cmd_fusion(instance, queue_num, irq_context);
 
 	return num_entries;
 }
diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.h b/drivers/scsi/megaraid/megaraid_sas_fusion.h
index ddeea0ee2834..70679f53bf9d 100644
--- a/drivers/scsi/megaraid/megaraid_sas_fusion.h
+++ b/drivers/scsi/megaraid/megaraid_sas_fusion.h
@@ -1313,8 +1313,6 @@ struct fusion_context {
 	u8 *sense;
 	dma_addr_t sense_phys_addr;
 
-	atomic_t   busy_mq_poll[MAX_MSIX_QUEUES_FUSION];
-
 	dma_addr_t reply_frames_desc_phys[MAX_MSIX_QUEUES_FUSION];
 	union MPI2_REPLY_DESCRIPTORS_UNION *reply_frames_desc[MAX_MSIX_QUEUES_FUSION];
 	struct rdpq_alloc_detail rdpq_tracker[RDPQ_MAX_CHUNK_COUNT];
-- 
2.50.1 (Apple Git-155)