This is a note to let you know that I've just added the patch titled
scsi: ufs: core: Fix racing issue between ufshcd_mcq_abort() and ISR
to the 6.6-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
scsi-ufs-core-fix-racing-issue-between-ufshcd_mcq_abort-and-isr.patch
and it can be found in the queue-6.6 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 27900d7119c464b43cd9eac69c85884d17bae240 Mon Sep 17 00:00:00 2001
From: Peter Wang <peter.wang@xxxxxxxxxxxx>
Date: Mon, 6 Nov 2023 15:51:17 +0800
Subject: scsi: ufs: core: Fix racing issue between ufshcd_mcq_abort() and ISR
From: Peter Wang <peter.wang@xxxxxxxxxxxx>
commit 27900d7119c464b43cd9eac69c85884d17bae240 upstream.
If command timeout happens and cq complete IRQ is raised at the same time,
ufshcd_mcq_abort clears lprb->cmd and a NULL pointer deref happens in the
ISR. Error log:
ufshcd_abort: Device abort task at tag 18
Unable to handle kernel NULL pointer dereference at virtual address
0000000000000108
pc : [0xffffffe27ef867ac] scsi_dma_unmap+0xc/0x44
lr : [0xffffffe27f1b898c] ufshcd_release_scsi_cmd+0x24/0x114
Fixes: f1304d442077 ("scsi: ufs: mcq: Added ufshcd_mcq_abort()")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Peter Wang <peter.wang@xxxxxxxxxxxx>
Link: https://lore.kernel.org/r/20231106075117.8995-1-peter.wang@xxxxxxxxxxxx
Reviewed-by: Bart Van Assche <bvanassche@xxxxxxx>
Signed-off-by: Martin K. Petersen <martin.petersen@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/ufs/core/ufs-mcq.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/ufs/core/ufs-mcq.c
+++ b/drivers/ufs/core/ufs-mcq.c
@@ -630,6 +630,7 @@ int ufshcd_mcq_abort(struct scsi_cmnd *c
int tag = scsi_cmd_to_rq(cmd)->tag;
struct ufshcd_lrb *lrbp = &hba->lrb[tag];
struct ufs_hw_queue *hwq;
+ unsigned long flags;
int err = FAILED;
if (!ufshcd_cmd_inflight(lrbp->cmd)) {
@@ -670,8 +671,10 @@ int ufshcd_mcq_abort(struct scsi_cmnd *c
}
err = SUCCESS;
+ spin_lock_irqsave(&hwq->cq_lock, flags);
if (ufshcd_cmd_inflight(lrbp->cmd))
ufshcd_release_scsi_cmd(hba, lrbp);
+ spin_unlock_irqrestore(&hwq->cq_lock, flags);
out:
return err;
Patches currently in stable-queue which might be from peter.wang@xxxxxxxxxxxx are
queue-6.6/scsi-ufs-core-fix-racing-issue-between-ufshcd_mcq_abort-and-isr.patch
queue-6.6/scsi-ufs-core-expand-mcq-queue-slot-to-devicequeuede.patch
