* [PATCH v2] ufs: core: fix racing issue between ufshcd_mcq_abort and ISR
@ 2023-11-06 7:51 peter.wang
2023-11-06 18:04 ` Bart Van Assche
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: peter.wang @ 2023-11-06 7:51 UTC (permalink / raw)
To: stanley.chu, linux-scsi, martin.petersen, avri.altman,
alim.akhtar, jejb
Cc: wsd_upstream, linux-mediatek, peter.wang, chun-hung.wu,
alice.chao, cc.chou, chaotian.jing, jiajie.hao, powen.kao,
qilin.tan, lin.gui, tun-yu.yu, eddie.huang, naomi.chu, stable
From: Peter Wang <peter.wang@mediatek.com>
If command timeout happen and cq complete irq raise at the same time,
ufshcd_mcq_abort null the lprb->cmd and NULL poiner KE in ISR.
Below is error log.
ufshcd_abort: Device abort task at tag 18
Unable to handle kernel NULL pointer dereference at virtual address
0000000000000108
pc : [0xffffffe27ef867ac] scsi_dma_unmap+0xc/0x44
lr : [0xffffffe27f1b898c] ufshcd_release_scsi_cmd+0x24/0x114
Fixes: f1304d442077 ("scsi: ufs: mcq: Added ufshcd_mcq_abort()")
Cc: stable@vger.kernel.org
Signed-off-by: Peter Wang <peter.wang@mediatek.com>
---
drivers/ufs/core/ufs-mcq.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/ufs/core/ufs-mcq.c b/drivers/ufs/core/ufs-mcq.c
index 2ba8ec254dce..6ea96406f2bf 100644
--- a/drivers/ufs/core/ufs-mcq.c
+++ b/drivers/ufs/core/ufs-mcq.c
@@ -630,6 +630,7 @@ int ufshcd_mcq_abort(struct scsi_cmnd *cmd)
int tag = scsi_cmd_to_rq(cmd)->tag;
struct ufshcd_lrb *lrbp = &hba->lrb[tag];
struct ufs_hw_queue *hwq;
+ unsigned long flags;
int err = FAILED;
if (!ufshcd_cmd_inflight(lrbp->cmd)) {
@@ -670,8 +671,10 @@ int ufshcd_mcq_abort(struct scsi_cmnd *cmd)
}
err = SUCCESS;
+ spin_lock_irqsave(&hwq->cq_lock, flags);
if (ufshcd_cmd_inflight(lrbp->cmd))
ufshcd_release_scsi_cmd(hba, lrbp);
+ spin_unlock_irqrestore(&hwq->cq_lock, flags);
out:
return err;
--
2.18.0
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH v2] ufs: core: fix racing issue between ufshcd_mcq_abort and ISR
2023-11-06 7:51 [PATCH v2] ufs: core: fix racing issue between ufshcd_mcq_abort and ISR peter.wang
@ 2023-11-06 18:04 ` Bart Van Assche
2023-11-09 2:40 ` Martin K. Petersen
2023-11-15 15:13 ` Martin K. Petersen
2 siblings, 0 replies; 4+ messages in thread
From: Bart Van Assche @ 2023-11-06 18:04 UTC (permalink / raw)
To: peter.wang, stanley.chu, linux-scsi, martin.petersen, avri.altman,
alim.akhtar, jejb
Cc: wsd_upstream, linux-mediatek, chun-hung.wu, alice.chao, cc.chou,
chaotian.jing, jiajie.hao, powen.kao, qilin.tan, lin.gui,
tun-yu.yu, eddie.huang, naomi.chu, stable
On 11/5/23 23:51, peter.wang@mediatek.com wrote:
> If command timeout happen and cq complete irq raise at the same time,
> ufshcd_mcq_abort null the lprb->cmd and NULL poiner KE in ISR.
> Below is error log.
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH v2] ufs: core: fix racing issue between ufshcd_mcq_abort and ISR
2023-11-06 7:51 [PATCH v2] ufs: core: fix racing issue between ufshcd_mcq_abort and ISR peter.wang
2023-11-06 18:04 ` Bart Van Assche
@ 2023-11-09 2:40 ` Martin K. Petersen
2023-11-15 15:13 ` Martin K. Petersen
2 siblings, 0 replies; 4+ messages in thread
From: Martin K. Petersen @ 2023-11-09 2:40 UTC (permalink / raw)
To: peter.wang
Cc: stanley.chu, linux-scsi, martin.petersen, avri.altman,
alim.akhtar, jejb, wsd_upstream, linux-mediatek, chun-hung.wu,
alice.chao, cc.chou, chaotian.jing, jiajie.hao, powen.kao,
qilin.tan, lin.gui, tun-yu.yu, eddie.huang, naomi.chu, stable
> If command timeout happen and cq complete irq raise at the same time,
> ufshcd_mcq_abort null the lprb->cmd and NULL poiner KE in ISR. Below
> is error log.
Applied to 6.7/scsi-staging, thanks!
--
Martin K. Petersen Oracle Linux Engineering
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH v2] ufs: core: fix racing issue between ufshcd_mcq_abort and ISR
2023-11-06 7:51 [PATCH v2] ufs: core: fix racing issue between ufshcd_mcq_abort and ISR peter.wang
2023-11-06 18:04 ` Bart Van Assche
2023-11-09 2:40 ` Martin K. Petersen
@ 2023-11-15 15:13 ` Martin K. Petersen
2 siblings, 0 replies; 4+ messages in thread
From: Martin K. Petersen @ 2023-11-15 15:13 UTC (permalink / raw)
To: stanley.chu, linux-scsi, avri.altman, alim.akhtar, jejb,
peter.wang
Cc: Martin K . Petersen, wsd_upstream, linux-mediatek, chun-hung.wu,
alice.chao, cc.chou, chaotian.jing, jiajie.hao, powen.kao,
qilin.tan, lin.gui, tun-yu.yu, eddie.huang, naomi.chu, stable
On Mon, 06 Nov 2023 15:51:17 +0800, peter.wang@mediatek.com wrote:
> If command timeout happen and cq complete irq raise at the same time,
> ufshcd_mcq_abort null the lprb->cmd and NULL poiner KE in ISR.
> Below is error log.
>
> ufshcd_abort: Device abort task at tag 18
> Unable to handle kernel NULL pointer dereference at virtual address
> 0000000000000108
> pc : [0xffffffe27ef867ac] scsi_dma_unmap+0xc/0x44
> lr : [0xffffffe27f1b898c] ufshcd_release_scsi_cmd+0x24/0x114
>
> [...]
Applied to 6.7/scsi-fixes, thanks!
[1/1] ufs: core: fix racing issue between ufshcd_mcq_abort and ISR
https://git.kernel.org/mkp/scsi/c/27900d7119c4
--
Martin K. Petersen Oracle Linux Engineering
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2023-11-15 15:13 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-11-06 7:51 [PATCH v2] ufs: core: fix racing issue between ufshcd_mcq_abort and ISR peter.wang
2023-11-06 18:04 ` Bart Van Assche
2023-11-09 2:40 ` Martin K. Petersen
2023-11-15 15:13 ` Martin K. Petersen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox