mirror of https://github.com/torvalds/linux.git
ee0e6e69a7
If the ata_qc_for_each_raw() loop finishes without finding a matching SCSI
command for any QC, the variable qc will hold a pointer to the last element
examined, which has the tag i == ATA_MAX_QUEUE - 1. This qc can match the
port deferred QC (ap->deferred_qc).
If that happens, the condition qc == ap->deferred_qc evaluates to true
despite the loop not breaking with a match on the SCSI command for this QC.
In that case, the error handler mistakenly intercepts a command that has
not been issued yet and that has not timed out, and thus erroneously
returning a timeout error.
Fix the problem by checking for i < ATA_MAX_QUEUE in addition to
qc == ap->deferred_qc.
The problem was found by an experimental code review agent based on
gemini-3.1-pro while reviewing backports into v6.18.y.
Assisted-by: Gemini:gemini-3.1-pro
Fixes:
|
||
|---|---|---|
| .. | ||
| pata_parport | ||
| Kconfig | ||
| Makefile | ||
| acard-ahci.c | ||
| ahci.c | ||
| ahci.h | ||
| ahci_brcm.c | ||
| ahci_ceva.c | ||
| ahci_da850.c | ||
| ahci_dm816.c | ||
| ahci_dwc.c | ||
| ahci_imx.c | ||
| ahci_mtk.c | ||
| ahci_mvebu.c | ||
| ahci_octeon.c | ||
| ahci_platform.c | ||
| ahci_qoriq.c | ||
| ahci_seattle.c | ||
| ahci_st.c | ||
| ahci_sunxi.c | ||
| ahci_tegra.c | ||
| ahci_xgene.c | ||
| ata_generic.c | ||
| ata_piix.c | ||
| libahci.c | ||
| libahci_platform.c | ||
| libata-acpi.c | ||
| libata-core.c | ||
| libata-eh.c | ||
| libata-pata-timings.c | ||
| libata-pmp.c | ||
| libata-sata.c | ||
| libata-scsi.c | ||
| libata-sff.c | ||
| libata-trace.c | ||
| libata-transport.c | ||
| libata-transport.h | ||
| libata-zpodd.c | ||
| libata.h | ||
| pata_acpi.c | ||
| pata_ali.c | ||
| pata_amd.c | ||
| pata_arasan_cf.c | ||
| pata_artop.c | ||
| pata_atiixp.c | ||
| pata_atp867x.c | ||
| pata_buddha.c | ||
| pata_cmd64x.c | ||
| pata_cmd640.c | ||
| pata_cs5520.c | ||
| pata_cs5530.c | ||
| pata_cs5535.c | ||
| pata_cs5536.c | ||
| pata_cypress.c | ||
| pata_efar.c | ||
| pata_ep93xx.c | ||
| pata_falcon.c | ||
| pata_ftide010.c | ||
| pata_gayle.c | ||
| pata_hpt3x2n.c | ||
| pata_hpt3x3.c | ||
| pata_hpt37x.c | ||
| pata_hpt366.c | ||
| pata_icside.c | ||
| pata_imx.c | ||
| pata_isapnp.c | ||
| pata_it821x.c | ||
| pata_it8213.c | ||
| pata_ixp4xx_cf.c | ||
| pata_jmicron.c | ||
| pata_legacy.c | ||
| pata_macio.c | ||
| pata_marvell.c | ||
| pata_mpc52xx.c | ||
| pata_mpiix.c | ||
| pata_netcell.c | ||
| pata_ninja32.c | ||
| pata_ns87410.c | ||
| pata_ns87415.c | ||
| pata_octeon_cf.c | ||
| pata_of_platform.c | ||
| pata_oldpiix.c | ||
| pata_opti.c | ||
| pata_optidma.c | ||
| pata_pcmcia.c | ||
| pata_pdc202xx_old.c | ||
| pata_pdc2027x.c | ||
| pata_piccolo.c | ||
| pata_platform.c | ||
| pata_pxa.c | ||
| pata_radisys.c | ||
| pata_rb532_cf.c | ||
| pata_rdc.c | ||
| pata_rz1000.c | ||
| pata_sc1200.c | ||
| pata_sch.c | ||
| pata_serverworks.c | ||
| pata_sil680.c | ||
| pata_sis.c | ||
| pata_sl82c105.c | ||
| pata_triflex.c | ||
| pata_via.c | ||
| pdc_adma.c | ||
| sata_dwc_460ex.c | ||
| sata_fsl.c | ||
| sata_gemini.c | ||
| sata_gemini.h | ||
| sata_highbank.c | ||
| sata_inic162x.c | ||
| sata_mv.c | ||
| sata_nv.c | ||
| sata_promise.c | ||
| sata_promise.h | ||
| sata_qstor.c | ||
| sata_rcar.c | ||
| sata_sil.c | ||
| sata_sil24.c | ||
| sata_sis.c | ||
| sata_svw.c | ||
| sata_sx4.c | ||
| sata_uli.c | ||
| sata_via.c | ||
| sata_vsc.c | ||
| sis.h | ||