From nobody Mon Apr 13 13:55:17 2026 Received: from mail-dl1-f49.google.com (mail-dl1-f49.google.com [74.125.82.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1DC693624C7 for ; Fri, 6 Mar 2026 02:48:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.49 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772765294; cv=none; b=A6D9/jr/iJda0NDu9ba1r7Tlf5BAqtSYwtB4z1WV7VLFznXj4BBbgigUevFUReKwJW8VQKAigKt9g7fArVT4l8KFtgYlZjTmOTms6sGbCnC+zdODI3bza+wtoSlHGTt8KgO2dMfGvCst0Q6eHheAZRfj9ByKOEbN9O2X0UA07XI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772765294; c=relaxed/simple; bh=MZ94Gzex02Jy1JLi10KCAdvW3FLEFCePVRR6Ggg34Dc=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=PT6zl+kiYn5NjYZ40D+lpxz3O/x+0uT7HkAd0YmIhPlevqP4mJw/Cj2FMU9dlqf5V9qzWSnGC2m5h8Jdvy/S1MTy6J/ZsgtCI9A+EOjXBXc7cFs+uyjf58yD9fhwzEO5KOxfwmmFfqGMVjxeUE+RDjFbafPlLL3n6N2VanoMHns= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=roeck-us.net; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=ik6euCoj; arc=none smtp.client-ip=74.125.82.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=roeck-us.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ik6euCoj" Received: by mail-dl1-f49.google.com with SMTP id a92af1059eb24-127380532eeso1980558c88.1 for ; Thu, 05 Mar 2026 18:48:11 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1772765291; x=1773370091; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:sender:from:to:cc:subject:date:message-id:reply-to; bh=CByE5Wxban3jbJS31rm9GTroSUFqouuJozzUiQuEg8A=; b=ik6euCojSJCVgXrAKvmajv4Qn+ATmbsAKuu2KuGG4FHqmNWUMkZ2Akbk9YqG12AloF uZKofM0Yo6DvvwbU2BkQzczzWC043JWlNBR+iZcRV/jqy6y59zCdxC0yJai+lyvhUGxE 9Adl1erXB+FZtFHoNjwgky2iF85wX89Pgus7rdw+ERM/jWsdXMWNaW8mb/NYVXB5Yw8S U0u6A5au1sy3pazb9Fgv7JGeVPUePI9t+OgqqM8mLnvy2SGjoQSBmmSoEMz/Egt4Z/+k Sfps7Rme8BsM6xsxVIvezPm6JnsNgftvDxf5+HeoS8oQJecY5whKFJ2TtfVxRL6DsLV4 /tiw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1772765291; x=1773370091; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:sender:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=CByE5Wxban3jbJS31rm9GTroSUFqouuJozzUiQuEg8A=; b=sW40lsDdLtR+FAjhKizAszP7rP1QkeAJZdjNEbS6IYYtGl4fcKnQ7LcTo6FGr61V+c 2QB410psjlSzp8mlFVh8pjYoHsBrqLBXG+tMi+ffxVyk884BjN9RH/uo0cg/n+VZoG6a H0sOGTJyU2yze4R3W1TzwdfjSFqTj1I6Ft8vGcw+4M1m/I0jzHXzHOV4G6Z1NVbSvGBD /WGo6bPTSLiLW0moM2lia+NlKRx37XaE6B51Nuhw2mUgV2jG31u8hFuBgRn518cxlcUc XiSjXJXI0uVZN4GrPmx2Vz+2gP5lhQy8RuY95jyBqvQEccopZB+YKut7O/FcZkrRG4PF JcUA== X-Forwarded-Encrypted: i=1; AJvYcCW0vAhgMF5RoOC5GzjzA1zsw2mbL6WxgSDUYiOjTtbEvpt0lfHDPAXvVTpiGFH6u9Z3+Wd0V0QWHaDx3ww=@vger.kernel.org X-Gm-Message-State: AOJu0YxDMaXNsHAzyYh6HptqYWmizxhhzUMaKRs3Leo1kebPuLjporwY B16aIWHMX3T7VrXAsWBmFMu7PccQFmujT1weD5dX5RMxiny6V9zZKg1F X-Gm-Gg: ATEYQzyiA/cs+4XRgoUumPX6qpR+/R1UoQ0mQfq3qLmYJmqT4mIVuoTtkWNCHWVWtyj Rmr6Ja7jqs7wforqaP0HwP4vZU4abmcpIeV1/earnkp6JJLhsMqKM+w91ot3gZ+Om74HUQzSe3L /2joQV1zeRTMYgJ0xVID/fMIIaNhQoWM2sqYZhjfVMZCbKCuDG/5BYFTo6hPl7s5yK6Lk63KoTb q4MK6js57vJEV4zKdBlj+JCU7a8DknE8GBFz6cPevPXas6sdQnHA3h9MGFU7rF3BB2+NRfdHdmj /iCf0JXAker6jYhLDA/+xNbvVtvWDMEZ3MqM5VPpzGx+ZsmGA7Q7Wxz+YZQlzmo26v1mWDKxKPm nXHKYx1xSreuPo51vOruOT3IoK2zzuB0X7BZHoFQcRrxj64FmAd5dSskix8vsZl1bSAidX8YyNX ARWIGTPJkZPvjMUu5eF2bhJyhBEmSQILMbZSqb X-Received: by 2002:a05:7022:217:b0:123:3309:1af2 with SMTP id a92af1059eb24-128c2ed35c8mr306488c88.46.1772765290941; Thu, 05 Mar 2026 18:48:10 -0800 (PST) Received: from server.roeck-us.net ([2600:1700:e321:62f0:da43:aeff:fecc:bfd5]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-128c4065933sm125376c88.16.2026.03.05.18.48.09 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Mar 2026 18:48:09 -0800 (PST) Sender: Guenter Roeck From: Guenter Roeck To: Damien Le Moal Cc: Niklas Cassel , linux-ide@vger.kernel.org, linux-kernel@vger.kernel.org, Guenter Roeck Subject: [PATCH] ata: libata-eh: Fix detection of deferred qc timeouts Date: Thu, 5 Mar 2026 18:48:05 -0800 Message-ID: <20260306024805.2877513-1-linux@roeck-us.net> X-Mailer: git-send-email 2.45.2 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" If the `ata_qc_for_each_raw()` loop finishes without finding a matching `scmd`, `qc` will hold a pointer to the last element examined, which is accociated with `i =3D=3D ATA_MAX_QUEUE - 1`. This element can match `ap->deferred_qc`. If that happens, the condition `qc =3D=3D ap->deferred_q= c` evaluates to true despite the loop not breaking on a scmd match. In that case, the error handler mistakenly intercepts a command that completed normally after an unrelated SCSI timeout, returning a timeout error instead of success. Fix the problem by checking for i < ATA_MAX_QUEUE in addition to qc =3D=3D ap->deferred_qc. The problem was found by an experimental code review agent based on gemini-3.1-pro while reviewing backports into v6.18.y. Assisted-by: Gemini:gemini-3.1-pro Cc: Damien Le Moal Cc: Niklas Cassel Fixes: eddb98ad9364 ("ata: libata-eh: correctly handle deferred qc timeouts= ") Signed-off-by: Guenter Roeck Reviewed-by: Damien Le Moal --- drivers/ata/libata-eh.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c index b373cceb95d2..44fddfbb7629 100644 --- a/drivers/ata/libata-eh.c +++ b/drivers/ata/libata-eh.c @@ -647,7 +647,7 @@ void ata_scsi_cmd_error_handler(struct Scsi_Host *host,= struct ata_port *ap, break; } =20 - if (qc =3D=3D ap->deferred_qc) { + if (i < ATA_MAX_QUEUE && qc =3D=3D ap->deferred_qc) { /* * This is a deferred command that timed out while * waiting for the command queue to drain. Since the qc --=20 2.45.2