If cq complete irq raise during abort processing, the command has already been complete. So could not get utag to erase cmd like below log. Because the cmd that was handling abort has already been completed ufshcd_try_to_abort_task: cmd pending in the device. tag = 25 Unable to handle kernel NULL pointer dereference at virtual address 0000000000000194 Mem abort info: ESR = 0x0000000096000006 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x06: level 2 translation fault Data abort info: ISV = 0, ISS = 0x00000006 CM = 0, WnR = 0 pc : blk_mq_unique_tag+0x8/0x14 lr : ufshcd_mcq_sq_cleanup+0x6c/0x1b8 Call trace: blk_mq_unique_tag+0x8/0x14 ufshcd_clear_cmd+0x34/0x118 ufshcd_try_to_abort_task+0x1c4/0x4b0 ufshcd_err_handler+0x8d0/0xd24 process_one_work+0x1e4/0x43c worker_thread+0x25c/0x430 kthread+0x104/0x1d4 ret_from_fork+0x10/0x20 Signed-off-by: SEO HOYOUNG <hy50.seo@xxxxxxxxxxx> --- drivers/ufs/core/ufshcd.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c index 9a730a794b66..1a58869b91fc 100644 --- a/drivers/ufs/core/ufshcd.c +++ b/drivers/ufs/core/ufshcd.c @@ -7574,6 +7574,10 @@ int ufshcd_try_to_abort_task(struct ufs_hba *hba, int tag) goto out; } + if (!ufshcd_cmd_inflight(cmd) || + test_bit(SCMD_STATE_COMPLETE, &cmd->state)) + goto out; + err = ufshcd_clear_cmd(hba, tag); if (err) dev_err(hba->dev, "%s: Failed clearing cmd at tag %d, err %d\n", -- 2.26.0
