scsi: core: clear driver private data when retry request

From: Ye Bin <yebin10@huawei.com>

After commit 1bad6c4a57ef
("scsi: zero per-cmd private driver data for each MQ I/O"),
xen-scsifront/virtio_scsi/snic driver remove code that zeroes
driver-private command data. If request do retry will lead to
driver-private command data remains. Before commit 464a00c9e0ad
("scsi: core: Kill DRIVER_SENSE") if virtio_scsi do capacity
expansion, first request may return UA then request will do retry,
as driver-private command data remains, request will return UA
again. As a result, the request keeps retrying, and the request
times out and fails.
So zeroes driver-private command data when request do retry.

Fixes: f7de50da1479 ("scsi: xen-scsifront: Remove code that zeroes driver-private command data")
Fixes: c2bb87318baa ("scsi: virtio_scsi: Remove code that zeroes driver-private command data")
Fixes: c3006a926468 ("scsi: snic: Remove code that zeroes driver-private command data")
Signed-off-by: Ye Bin <yebin10@huawei.com>
---
 drivers/scsi/scsi_lib.c | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

On 2/10/25 6:03 AM, Ye Bin wrote:
> From: Ye Bin <yebin10@huawei.com>
> 
> After commit 1bad6c4a57ef
> ("scsi: zero per-cmd private driver data for each MQ I/O"),
> xen-scsifront/virtio_scsi/snic driver remove code that zeroes
> driver-private command data. If request do retry will lead to
> driver-private command data remains. Before commit 464a00c9e0ad
> ("scsi: core: Kill DRIVER_SENSE") if virtio_scsi do capacity
> expansion, first request may return UA then request will do retry,
> as driver-private command data remains, request will return UA
> again. As a result, the request keeps retrying, and the request
> times out and fails.
> So zeroes driver-private command data when request do retry.
> 
> Fixes: f7de50da1479 ("scsi: xen-scsifront: Remove code that zeroes driver-private command data")
> Fixes: c2bb87318baa ("scsi: virtio_scsi: Remove code that zeroes driver-private command data")
> Fixes: c3006a926468 ("scsi: snic: Remove code that zeroes driver-private command data")
> Signed-off-by: Ye Bin <yebin10@huawei.com>
> ---
>   drivers/scsi/scsi_lib.c | 19 +++++++++++++------
>   1 file changed, 13 insertions(+), 6 deletions(-)
> 
> diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
> index be0890e4e706..5b0c109c89bb 100644
> --- a/drivers/scsi/scsi_lib.c
> +++ b/drivers/scsi/scsi_lib.c
> @@ -1645,6 +1645,17 @@ static unsigned int scsi_mq_inline_sgl_size(struct Scsi_Host *shost)
>   		sizeof(struct scatterlist);
>   }
>   
> +static inline void scsi_clear_lld_private_data(struct scsi_cmnd *cmd,
> +					       struct Scsi_Host *shost)
> +{
> +	/*
> +	 * Only clear the driver-private command data if the LLD does not supply
> +	 * a function to initialize that data.
> +	 */
> +	if (!shost->hostt->init_cmd_priv && shost->hostt->cmd_size)
> +		memset(cmd + 1, 0, shost->hostt->cmd_size);
> +}
> +
>   static blk_status_t scsi_prepare_cmd(struct request *req)
>   {
>   	struct scsi_cmnd *cmd = blk_mq_rq_to_pdu(req);
> @@ -1669,12 +1680,7 @@ static blk_status_t scsi_prepare_cmd(struct request *req)
>   	if (in_flight)
>   		__set_bit(SCMD_STATE_INFLIGHT, &cmd->state);
>   
> -	/*
> -	 * Only clear the driver-private command data if the LLD does not supply
> -	 * a function to initialize that data.
> -	 */
> -	if (!shost->hostt->init_cmd_priv)
> -		memset(cmd + 1, 0, shost->hostt->cmd_size);
> +	scsi_clear_lld_private_data(cmd, shost);
>   
>   	cmd->prot_op = SCSI_PROT_NORMAL;
>   	if (blk_rq_bytes(req))
> @@ -1848,6 +1854,7 @@ static blk_status_t scsi_queue_rq(struct blk_mq_hw_ctx *hctx,
>   			goto out_dec_host_busy;
>   		req->rq_flags |= RQF_DONTPREP;
>   	} else {
> +		scsi_clear_lld_private_data(cmd, shost);
>   		clear_bit(SCMD_STATE_COMPLETE, &cmd->state);
>   	}

Thanks for the detailed analysis. Has the following (untested) simpler
alternative been considered?

diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index d776f13cd160..6ee2903b4adb 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1664,13 +1664,6 @@ static blk_status_t scsi_prepare_cmd(struct 
request *req)
  	if (in_flight)
  		__set_bit(SCMD_STATE_INFLIGHT, &cmd->state);

-	/*
-	 * Only clear the driver-private command data if the LLD does not supply
-	 * a function to initialize that data.
-	 */
-	if (!shost->hostt->init_cmd_priv)
-		memset(cmd + 1, 0, shost->hostt->cmd_size);
-
  	cmd->prot_op = SCSI_PROT_NORMAL;
  	if (blk_rq_bytes(req))
  		cmd->sc_data_direction = rq_dma_dir(req);
@@ -1837,6 +1830,13 @@ static blk_status_t scsi_queue_rq(struct 
blk_mq_hw_ctx *hctx,
  	if (!scsi_host_queue_ready(q, shost, sdev, cmd))
  		goto out_dec_target_busy;

+	/*
+	 * Only clear the driver-private command data if the LLD does not supply
+	 * a function to initialize that data.
+	 */
+	if (!shost->hostt->init_cmd_priv && shost->hostt->cmd_size)
+		memset(scsi_cmd_priv(cmd), 0, shost->hostt->cmd_size);
+
  	if (!(req->rq_flags & RQF_DONTPREP)) {
  		ret = scsi_prepare_cmd(req);
  		if (ret != BLK_STS_OK)