linux/drivers/ufs/core
Peter Wang 27900d7119 scsi: ufs: core: Fix racing issue between ufshcd_mcq_abort() and ISR
If command timeout happens and cq complete IRQ is raised at the same time,
ufshcd_mcq_abort clears lprb->cmd and a NULL pointer deref happens in the
ISR. Error log:

ufshcd_abort: Device abort task at tag 18
Unable to handle kernel NULL pointer dereference at virtual address
0000000000000108
pc : [0xffffffe27ef867ac] scsi_dma_unmap+0xc/0x44
lr : [0xffffffe27f1b898c] ufshcd_release_scsi_cmd+0x24/0x114

Fixes: f1304d4420 ("scsi: ufs: mcq: Added ufshcd_mcq_abort()")
Cc: stable@vger.kernel.org
Signed-off-by: Peter Wang <peter.wang@mediatek.com>
Link: https://lore.kernel.org/r/20231106075117.8995-1-peter.wang@mediatek.com
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2023-11-08 21:40:41 -05:00
..
Kconfig scsi: ufs: core: Remove HPB support 2023-07-23 16:40:39 -04:00
Makefile scsi: ufs: core: Remove HPB support 2023-07-23 16:40:39 -04:00
ufs_bsg.c scsi: ufs: core: Add advanced RPMB support where UFSHCI 4.0 does not support EHS length in UTRD 2023-08-30 21:42:30 -04:00
ufs_bsg.h
ufs-debugfs.c
ufs-debugfs.h
ufs-fault-injection.c scsi: ufs: Replace all non-returning strlcpy() with strscpy() 2023-05-31 18:06:54 -04:00
ufs-fault-injection.h
ufs-hwmon.c scsi: ufs: Rename a function argument 2023-07-31 15:17:50 -04:00
ufs-mcq.c scsi: ufs: core: Fix racing issue between ufshcd_mcq_abort() and ISR 2023-11-08 21:40:41 -05:00
ufs-sysfs.c scsi: ufs: core: Remove HPB support 2023-07-23 16:40:39 -04:00
ufs-sysfs.h
ufshcd-crypto.c scsi: ufs: Ungate the clock synchronously 2023-05-31 11:44:01 -04:00
ufshcd-crypto.h scsi: ufs: Simplify transfer request header initialization 2023-07-31 15:17:51 -04:00
ufshcd-priv.h scsi: ufs: Improve type safety 2023-07-31 15:17:50 -04:00
ufshcd.c scsi: ufs: core: Leave space for '\0' in utf8 desc string 2023-10-24 22:46:33 -04:00