Hi, Bart > + req = blk_get_request(q, REQ_OP_DRV_OUT, 0); > + if (IS_ERR(req)) > + return PTR_ERR(req); > + tag = req->tag; > + WARN_ON_ONCE(!ufshcd_valid_tag(hba, tag)); .... > &tag)); > + req = blk_get_request(q, REQ_OP_DRV_OUT, 0); > + if (IS_ERR(req)) > + return PTR_ERR(req); > + tag = req->tag; > + WARN_ON_ONCE(!ufshcd_valid_tag(hba, tag)); > ...... > > + err = -ENOMEM; > + hba->cmd_queue = blk_mq_init_queue(&hba->host->tag_set); > + if (!hba->cmd_queue) It is possible to return ERR_PTR(-ENOMEM) in blk_mq_init_queue(),, Here just checkup if not NULL is not safe enough. //Bean