Commit 27900d71 authored by Peter Wang's avatar Peter Wang Committed by Martin K. Petersen
Browse files

scsi: ufs: core: Fix racing issue between ufshcd_mcq_abort() and ISR 



If command timeout happens and cq complete IRQ is raised at the same time,
ufshcd_mcq_abort clears lprb->cmd and a NULL pointer deref happens in the
ISR. Error log:

ufshcd_abort: Device abort task at tag 18
Unable to handle kernel NULL pointer dereference at virtual address
0000000000000108
pc : [0xffffffe27ef867ac] scsi_dma_unmap+0xc/0x44
lr : [0xffffffe27f1b898c] ufshcd_release_scsi_cmd+0x24/0x114

Fixes: f1304d44 ("scsi: ufs: mcq: Added ufshcd_mcq_abort()")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarPeter Wang <peter.wang@mediatek.com>
Link: https://lore.kernel.org/r/20231106075117.8995-1-peter.wang@mediatek.com


Reviewed-by: default avatarBart Van Assche <bvanassche@acm.org>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent defde5a5

drivers/ufs/core/ufs-mcq.c

+3 −0
Original line number Diff line number Diff line
@@ -630,6 +630,7 @@ int ufshcd_mcq_abort(struct scsi_cmnd *cmd) 
	int tag = scsi_cmd_to_rq(cmd)->tag;

	struct ufshcd_lrb *lrbp = &hba->lrb[tag];

	struct ufs_hw_queue *hwq;

	unsigned long flags;

	int err = FAILED;



	if (!ufshcd_cmd_inflight(lrbp->cmd)) {
@@ -670,8 +671,10 @@ int ufshcd_mcq_abort(struct scsi_cmnd *cmd) 
	}



	err = SUCCESS;

	spin_lock_irqsave(&hwq->cq_lock, flags);

	if (ufshcd_cmd_inflight(lrbp->cmd))

		ufshcd_release_scsi_cmd(hba, lrbp);

	spin_unlock_irqrestore(&hwq->cq_lock, flags);



out:

	return err;