Hi Bart, > @@ -6979,24 +6966,15 @@ static int ufshcd_try_to_abort_task(struct ufs_hba *hba, int tag) > */ > static int ufshcd_abort(struct scsi_cmnd *cmd) > { > - struct Scsi_Host *host; > - struct ufs_hba *hba; > + struct Scsi_Host *host = cmd->device->host; > + struct ufs_hba *hba = shost_priv(host); > + unsigned int tag = cmd->request->tag; > + struct ufshcd_lrb *lrbp = &hba->lrb[tag]; If tag < 0, lrbp will be assigned incorrect pointer. > unsigned long flags; > - unsigned int tag; > int err = 0; > - struct ufshcd_lrb *lrbp; > u32 reg; > > - host = cmd->device->host; > - hba = shost_priv(host); > - tag = cmd->request->tag; > - lrbp = &hba->lrb[tag]; > - if (!ufshcd_valid_tag(hba, tag)) { > - dev_err(hba->dev, > - "%s: invalid command tag %d: cmd=0x%p, cmd->request=0x%p", > - __func__, tag, cmd, cmd->request); > - BUG(); > - } > + WARN_ONCE(tag < 0, "Invalid tag %d\n", tag); > > ufshcd_hold(hba, false); > reg = ufshcd_readl(hba, REG_UTP_TRANSFER_REQ_DOOR_BELL); Thanks, Daejun