Skip to content

Commit 27900d7

Browse files
ptr324martinkpetersen
authored andcommitted
scsi: ufs: core: Fix racing issue between ufshcd_mcq_abort() and ISR
If command timeout happens and cq complete IRQ is raised at the same time, ufshcd_mcq_abort clears lprb->cmd and a NULL pointer deref happens in the ISR. Error log: ufshcd_abort: Device abort task at tag 18 Unable to handle kernel NULL pointer dereference at virtual address 0000000000000108 pc : [0xffffffe27ef867ac] scsi_dma_unmap+0xc/0x44 lr : [0xffffffe27f1b898c] ufshcd_release_scsi_cmd+0x24/0x114 Fixes: f1304d4 ("scsi: ufs: mcq: Added ufshcd_mcq_abort()") Cc: stable@vger.kernel.org Signed-off-by: Peter Wang <peter.wang@mediatek.com> Link: https://lore.kernel.org/r/20231106075117.8995-1-peter.wang@mediatek.com Reviewed-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
1 parent defde5a commit 27900d7

File tree

1 file changed

+3
-0
lines changed

1 file changed

+3
-0
lines changed

drivers/ufs/core/ufs-mcq.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -630,6 +630,7 @@ int ufshcd_mcq_abort(struct scsi_cmnd *cmd)
630630
int tag = scsi_cmd_to_rq(cmd)->tag;
631631
struct ufshcd_lrb *lrbp = &hba->lrb[tag];
632632
struct ufs_hw_queue *hwq;
633+
unsigned long flags;
633634
int err = FAILED;
634635

635636
if (!ufshcd_cmd_inflight(lrbp->cmd)) {
@@ -670,8 +671,10 @@ int ufshcd_mcq_abort(struct scsi_cmnd *cmd)
670671
}
671672

672673
err = SUCCESS;
674+
spin_lock_irqsave(&hwq->cq_lock, flags);
673675
if (ufshcd_cmd_inflight(lrbp->cmd))
674676
ufshcd_release_scsi_cmd(hba, lrbp);
677+
spin_unlock_irqrestore(&hwq->cq_lock, flags);
675678

676679
out:
677680
return err;

0 commit comments

Comments
 (0)