Re: [PATCH v3] scsi: ufs: core: Keep internal commands dispatchable during error handling

[Stanley Jhu <stanleyjhu@google.com>]

On Sat, 12 Sep 2026 13:37:39 +0000, sashiko-bot@kernel.org wrote:
> Is it possible for hba->host->pseudo_sdev and its request_queue to be freed
> before we access it here?

If that race is reachable, it is not reachable through the code this patch
adds. The same function already dereferences a pointer that teardown frees
earlier than pseudo_sdev, and it does so before the new code runs:

drivers/ufs/core/ufshcd.c:ufshcd_err_handling_prepare() {
	pm_runtime_get_sync(hba->dev);
	ufshcd_rpm_get_sync(hba);
	if (pm_runtime_status_suspended(&hba->ufs_device_wlun->sdev_gendev) ||   <-- existing
	    hba->is_sys_suspended) {
	...
	blk_mq_quiesce_tagset(&hba->host->tag_set);
	blk_mq_unquiesce_queue(hba->host->pseudo_sdev->request_queue);          <-- added here
}

And the pseudo device is freed last, by design:

drivers/scsi/scsi_scan.c:scsi_forget_host() {
	list_for_each_entry(sdev, &shost->__devices, siblings) {
		if (scsi_device_is_pseudo_dev(sdev) ||
		    sdev->sdev_state == SDEV_DEL)
			continue;
		__scsi_remove_device(sdev);            /* the UFS Device WLUN goes here */
		...
	}
	/*
	 * Remove the pseudo device last since it may be needed during removal
	 * of other SCSI devices.
	 */
	if (shost->pseudo_sdev)
		__scsi_remove_device(shost->pseudo_sdev);
}

So any error handler run that reaches the new line has already dereferenced
ufs_device_wlun, which was freed first. The same holds for
ufshcd_err_handling_unprepare(), which only runs after prepare().

Thanks,
Stanley Jhu