title: scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler
description: In the Linux kernel, the following vulnerability has been resolved:
scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler
Inside scsi_eh_wakeup(), scsi_host_busy() is called & checked with host
lock every time for deciding if error handler kthread needs to be waken up.
This can be too heavy in case of recovery, such as:
- N hardware queues
- queue depth is M for each hardware queue
- each scsi_host_busy() iterates over (N * M) tag/requests
If recovery is triggered in case that all requests are in-flight, each
scsi_eh_wakeup() is strictly serialized, when scsi_eh_wakeup() is called
for the last in-flight request, scsi_host_busy() has been run for (N * M -
1) times, and request has been iterated for (N*M - 1) * (N * M) times.
If both N and M are big enough, hard lockup can be triggered on acquiring
host lock, and it is observed on mpi3mr(128 hw queues, queue depth 8169).
Fix the issue by calling scsi_host_busy() outside the host lock. We don't
need the host lock for getting busy count because host the lock never
covers that.
[mkp: Drop unnecessary 'busy' variables pointed out by Bart]
affected:
{
product: Linux
vendor: Linux
defaultStatus: unaffected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: 6eb045e092ef, lessThan: f5944853f7a9, status: affected, versionType: git
version: 6eb045e092ef, lessThan: d37c1c81419f, status: affected, versionType: git
version: 6eb045e092ef, lessThan: db6338f45971, status: affected, versionType: git
version: 6eb045e092ef, lessThan: 65ead8468c21, status: affected, versionType: git
version: 6eb045e092ef, lessThan: 07e3ca0f17f5, status: affected, versionType: git
version: 6eb045e092ef, lessThan: 4373534a9850, status: affected, versionType: git
}
{
product: Linux
vendor: Linux
defaultStatus: affected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: 5.5, status: affected
version: 0, lessThan: 5.5, status: unaffected, versionType: custom
version: 5.10.210, lessThanOrEqual: 5.10.*, status: unaffected, versionType: custom
version: 5.15.149, lessThanOrEqual: 5.15.*, status: unaffected, versionType: custom
version: 6.1.77, lessThanOrEqual: 6.1.*, status: unaffected, versionType: custom
version: 6.6.16, lessThanOrEqual: 6.6.*, status: unaffected, versionType: custom
version: 6.7.4, lessThanOrEqual: 6.7.*, status: unaffected, versionType: custom
version: 6.8, lessThanOrEqual: *, status: unaffected, versionType: original_commit_for_fix
}
