diff mbox series

[v2] ufs: core: fix racing issue between ufshcd_mcq_abort and ISR

Message ID 20231106075117.8995-1-peter.wang@mediatek.com
State New
Headers show
Series [v2] ufs: core: fix racing issue between ufshcd_mcq_abort and ISR | expand

Commit Message

Peter Wang (王信友) Nov. 6, 2023, 7:51 a.m. UTC 
From: Peter Wang <peter.wang@mediatek.com>

If command timeout happen and cq complete irq raise at the same time,
ufshcd_mcq_abort null the lprb->cmd and NULL poiner KE in ISR.
Below is error log.

ufshcd_abort: Device abort task at tag 18
Unable to handle kernel NULL pointer dereference at virtual address
0000000000000108
pc : [0xffffffe27ef867ac] scsi_dma_unmap+0xc/0x44
lr : [0xffffffe27f1b898c] ufshcd_release_scsi_cmd+0x24/0x114

Fixes: f1304d442077 ("scsi: ufs: mcq: Added ufshcd_mcq_abort()")
Cc: stable@vger.kernel.org
Signed-off-by: Peter Wang <peter.wang@mediatek.com>
---
 drivers/ufs/core/ufs-mcq.c | 3 +++
 1 file changed, 3 insertions(+)

Comments

Bart Van Assche Nov. 6, 2023, 6:04 p.m. UTC | #1 
On 11/5/23 23:51, peter.wang@mediatek.com wrote:
> If command timeout happen and cq complete irq raise at the same time,
> ufshcd_mcq_abort null the lprb->cmd and NULL poiner KE in ISR.
> Below is error log.

Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Martin K. Petersen Nov. 9, 2023, 2:40 a.m. UTC | #2 
> If command timeout happen and cq complete irq raise at the same time,
> ufshcd_mcq_abort null the lprb->cmd and NULL poiner KE in ISR. Below
> is error log.

Applied to 6.7/scsi-staging, thanks!
Martin K. Petersen Nov. 15, 2023, 3:13 p.m. UTC | #3 
On Mon, 06 Nov 2023 15:51:17 +0800, peter.wang@mediatek.com wrote:

> If command timeout happen and cq complete irq raise at the same time,
> ufshcd_mcq_abort null the lprb->cmd and NULL poiner KE in ISR.
> Below is error log.
> 
> ufshcd_abort: Device abort task at tag 18
> Unable to handle kernel NULL pointer dereference at virtual address
> 0000000000000108
> pc : [0xffffffe27ef867ac] scsi_dma_unmap+0xc/0x44
> lr : [0xffffffe27f1b898c] ufshcd_release_scsi_cmd+0x24/0x114
> 
> [...]

Applied to 6.7/scsi-fixes, thanks!

[1/1] ufs: core: fix racing issue between ufshcd_mcq_abort and ISR
      https://git.kernel.org/mkp/scsi/c/27900d7119c4
diff mbox series

Patch

diff --git a/drivers/ufs/core/ufs-mcq.c b/drivers/ufs/core/ufs-mcq.c
index 2ba8ec254dce..6ea96406f2bf 100644
--- a/drivers/ufs/core/ufs-mcq.c
+++ b/drivers/ufs/core/ufs-mcq.c
@@ -630,6 +630,7 @@  int ufshcd_mcq_abort(struct scsi_cmnd *cmd)
 	int tag = scsi_cmd_to_rq(cmd)->tag;
 	struct ufshcd_lrb *lrbp = &hba->lrb[tag];
 	struct ufs_hw_queue *hwq;
+	unsigned long flags;
 	int err = FAILED;
 
 	if (!ufshcd_cmd_inflight(lrbp->cmd)) {
@@ -670,8 +671,10 @@  int ufshcd_mcq_abort(struct scsi_cmnd *cmd)
 	}
 
 	err = SUCCESS;
+	spin_lock_irqsave(&hwq->cq_lock, flags);
 	if (ufshcd_cmd_inflight(lrbp->cmd))
 		ufshcd_release_scsi_cmd(hba, lrbp);
+	spin_unlock_irqrestore(&hwq->cq_lock, flags);
 
 out:
 	return err;