scsi: ufs: core: Fix task management completion timeout race
authorAdrian Hunter <adrian.hunter@intel.com>
Mon, 8 Nov 2021 06:48:14 +0000 (08:48 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 25 Nov 2021 08:48:38 +0000 (09:48 +0100)
commitbede57a71a680f96b2cecc08841605ae06be57c3
treef7ea55dda5ebf73d88ab2d2d0f7868f4cae1ee74
parentbcc0e3175a976b7fa9a353960808adb0bb49ead8
scsi: ufs: core: Fix task management completion timeout race

[ Upstream commit 886fe2915cce6658b0fc19e64b82879325de61ea ]

__ufshcd_issue_tm_cmd() clears req->end_io_data after timing out, which
races with the completion function ufshcd_tmc_handler() which expects
req->end_io_data to have a value.

Note __ufshcd_issue_tm_cmd() and ufshcd_tmc_handler() are already
synchronized using hba->tmf_rqs and hba->outstanding_tasks under the
host_lock spinlock.

It is also not necessary (nor typical) to clear req->end_io_data because
the block layer does it before allocating out requests e.g. via
blk_get_request().

So fix by not clearing it.

Link: https://lore.kernel.org/r/20211108064815.569494-2-adrian.hunter@intel.com
Fixes: f5ef336fd2e4 ("scsi: ufs: core: Fix task management completion")
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/scsi/ufs/ufshcd.c