scsi: ufs: core: Fix racing issue between ufshcd_mcq_abort() and ISR
authorPeter Wang <peter.wang@mediatek.com>
Mon, 6 Nov 2023 07:51:17 +0000 (15:51 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 28 Nov 2023 17:19:55 +0000 (17:19 +0000)
commitf84d461f33a6b27304d468d9cfb56c0cefdb4ee7
treeb3db57dad77f58ede85591e73764580946ebf8b8
parentd03346d4ab4b68ca2bde66f5582d6f4e3433886d
scsi: ufs: core: Fix racing issue between ufshcd_mcq_abort() and ISR

commit 27900d7119c464b43cd9eac69c85884d17bae240 upstream.

If command timeout happens and cq complete IRQ is raised at the same time,
ufshcd_mcq_abort clears lprb->cmd and a NULL pointer deref happens in the
ISR. Error log:

ufshcd_abort: Device abort task at tag 18
Unable to handle kernel NULL pointer dereference at virtual address
0000000000000108
pc : [0xffffffe27ef867ac] scsi_dma_unmap+0xc/0x44
lr : [0xffffffe27f1b898c] ufshcd_release_scsi_cmd+0x24/0x114

Fixes: f1304d442077 ("scsi: ufs: mcq: Added ufshcd_mcq_abort()")
Cc: stable@vger.kernel.org
Signed-off-by: Peter Wang <peter.wang@mediatek.com>
Link: https://lore.kernel.org/r/20231106075117.8995-1-peter.wang@mediatek.com
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/ufs/core/ufs-mcq.c