[PATCH v2 2/3] usb: uas: fail command submission on fatal USB errors

[Sarthak Kukreti <sarthakkukreti@google.com>]

uas_queuecommand_lck() only treats -ENODEV from uas_submit_urbs() as a
fatal submission error. When a link drops or an endpoint is disabled
while hub_wq is frozen, usb_submit_urb() can also fail with -ESHUTDOWN,
-ENOENT, or -EHOSTUNREACH, causing uas_queuecommand_lck() to return
SCSI_MLQUEUE_DEVICE_BUSY or queue retry work. In addition, if status or
data URB submission succeeds before a later URB submission fails,
uas_queuecommand_lck() either leaks unsubmitted URBs and orphans the
status URB, or leaves SUBMIT_CMD_URB set and COMMAND_INFLIGHT clear so
the command never completes.

Fail commands with DID_NO_CONNECT on -ESHUTDOWN, -ENOENT, and
-EHOSTUNREACH in uas_queuecommand_lck(), free unsubmitted URBs, and
unlink any already-submitted status or data URBs outside devinfo->lock.

Fixes: 26d56a9fcb20 ("usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer")
Signed-off-by: Sarthak Kukreti <sarthakkukreti@google.com>
---
 drivers/usb/storage/uas.c | 48 ++++++++++++++++++++++++++++++++++-----
 1 file changed, 42 insertions(+), 6 deletions(-)

diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c
index 904b4ce04fc6..951d85b2e7ac 100644
--- a/drivers/usb/storage/uas.c
+++ b/drivers/usb/storage/uas.c
@@ -756,12 +756,49 @@ static enum scsi_qc_status uas_queuecommand_lck(struct scsi_cmnd *cmnd)
 	 * a command that has finished is a success for the purpose
 	 * of queueing, no matter how fatal the error
 	 */
-	if (err == -ENODEV) {
-		if (cmdinfo->state & (COMMAND_INFLIGHT | DATA_IN_URB_INFLIGHT |
-				DATA_OUT_URB_INFLIGHT))
-			goto out;
-
+	if (err == -ENODEV || err == -ESHUTDOWN || err == -ENOENT ||
+	    err == -EHOSTUNREACH) {
 		set_host_byte(cmnd, DID_NO_CONNECT);
+		uas_free_unsubmitted_urbs(cmnd);
+		if (cmdinfo->sense_urb ||
+		    (cmdinfo->state & (COMMAND_INFLIGHT |
+				       DATA_IN_URB_INFLIGHT |
+				       DATA_OUT_URB_INFLIGHT))) {
+			struct urb *sense_urb = usb_get_urb(cmdinfo->sense_urb);
+			struct urb *data_in_urb = NULL;
+			struct urb *data_out_urb = NULL;
+
+			if (cmdinfo->sense_urb)
+				cmdinfo->state |= COMMAND_INFLIGHT;
+			if (cmdinfo->state & DATA_IN_URB_INFLIGHT)
+				data_in_urb = usb_get_urb(cmdinfo->data_in_urb);
+			if (cmdinfo->state & DATA_OUT_URB_INFLIGHT)
+				data_out_urb = usb_get_urb(cmdinfo->data_out_urb);
+			cmdinfo->state &= ~(SUBMIT_STATUS_URB |
+					    ALLOC_DATA_IN_URB |
+					    SUBMIT_DATA_IN_URB |
+					    ALLOC_DATA_OUT_URB |
+					    SUBMIT_DATA_OUT_URB |
+					    ALLOC_CMD_URB |
+					    SUBMIT_CMD_URB);
+			devinfo->cmnd[idx] = cmnd;
+			spin_unlock_irqrestore(&devinfo->lock, flags);
+
+			if (sense_urb) {
+				usb_unlink_urb(sense_urb);
+				usb_put_urb(sense_urb);
+			}
+			if (data_in_urb) {
+				usb_unlink_urb(data_in_urb);
+				usb_put_urb(data_in_urb);
+			}
+			if (data_out_urb) {
+				usb_unlink_urb(data_out_urb);
+				usb_put_urb(data_out_urb);
+			}
+			return 0;
+		}
+
 		scsi_done(cmnd);
 		goto zombie;
 	}
@@ -774,7 +811,6 @@ static enum scsi_qc_status uas_queuecommand_lck(struct scsi_cmnd *cmnd)
 		uas_add_work(cmnd);
 	}
 
-out:
 	devinfo->cmnd[idx] = cmnd;
 zombie:
 	spin_unlock_irqrestore(&devinfo->lock, flags);
-- 
2.56.0.611.g1030f0b940-goog