Commit 4c324085 authored Apr 09, 2025 by Chenyuan Yang Committed by Martin K. Petersen Apr 11, 2025

scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort()



A race can occur between the MCQ completion path and the abort handler:
once a request completes, __blk_mq_free_request() sets rq->mq_hctx to
NULL, meaning the subsequent ufshcd_mcq_req_to_hwq() call in
ufshcd_mcq_abort() can return a NULL pointer. If this NULL pointer is
dereferenced, the kernel will crash.

Add a NULL check for the returned hwq pointer. If hwq is NULL, log an
error and return FAILED, preventing a potential NULL-pointer
dereference.  As suggested by Bart, the ufshcd_cmd_inflight() check is
removed.

This is similar to the fix in commit 74736103 ("scsi: ufs: core: Fix
ufshcd_abort_one racing issue").

This is found by our static analysis tool KNighter.

Signed-off-by: Chenyuan Yang <chenyuan0y@gmail.com>
Link: https://lore.kernel.org/r/20250410001320.2219341-1-chenyuan0y@gmail.com


Fixes: f1304d44 ("scsi: ufs: mcq: Added ufshcd_mcq_abort()")
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Peter Wang <peter.wang@mediatek.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

parent a1af6f1a

drivers/ufs/core/ufs-mcq.c

+5 −7

Original line number	Diff line number	Diff line
		@@ -677,13 +677,6 @@ int ufshcd_mcq_abort(struct scsi_cmnd *cmd)
		unsigned long flags;
		int err;

		if (!ufshcd_cmd_inflight(lrbp->cmd)) {
		dev_err(hba->dev,
		"%s: skip abort. cmd at tag %d already completed.\n",
		__func__, tag);
		return FAILED;
		}

		/* Skip task abort in case previous aborts failed and report failure */
		if (lrbp->req_abort_skip) {
		dev_err(hba->dev, "%s: skip abort. tag %d failed earlier\n",
		@@ -692,6 +685,11 @@ int ufshcd_mcq_abort(struct scsi_cmnd *cmd)
		}

		hwq = ufshcd_mcq_req_to_hwq(hba, scsi_cmd_to_rq(cmd));
		if (!hwq) {
		dev_err(hba->dev, "%s: skip abort. cmd at tag %d already completed.\n",
		__func__, tag);
		return FAILED;
		}

		if (ufshcd_mcq_sqe_search(hba, hwq, tag)) {
		/*