projects
/
platform
/
kernel
/
linux-starfive.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
e9076e7
)
scsi: ufs: core: Fix NULL pointer dereference
author
Bean Huo
<beanhuo@micron.com>
Wed, 29 Sep 2021 20:06:38 +0000
(22:06 +0200)
committer
Martin K. Petersen
<martin.petersen@oracle.com>
Tue, 5 Oct 2021 02:19:22 +0000
(22:19 -0400)
Calling ufshcd_rpm_{get/put}_sync() prior to ufshcd_scsi_add_wlus() being
called will trigger a NULL pointer dereference. This is because
hba->sdev_ufs_device is initialized in ufshcd_scsi_add_wlus().
Unable to handle kernel NULL pointer dereference at virtual address
0000000000000348
Mem abort info:
ESR = 0x96000004
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x04: level 0 translation fault
Data abort info:
ISV = 0, ISS = 0x00000004
CM = 0, WnR = 0
[
0000000000000348
] user address but active_mm is swapper
Internal error: Oops:
96000004
[#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 91 Comm: kworker/u16:1 Not tainted 5.15.0-rc1-beanhuo-linaro-1423
Hardware name: MicronRB (DT)
Workqueue: events_unbound async_run_entry_fn
pstate:
20000005
(nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : pm_runtime_drop_link+0x128/0x338
lr : ufshpb_get_dev_info+0x8c/0x148
sp :
ffff800012573c10
x29:
ffff800012573c10
x28:
0000000000000000
x27:
0000000000000003
x26:
ffff000001d21298
x25:
000000005abcea60
x24:
ffff800011d89000
x23:
0000000000000001
x22:
ffff000001d21880
x21:
ffff000001ec9300
x20:
0000000000000004
x19:
0000000000000198
x18:
ffffffffffffffff
x17:
0000000000000000
x16:
0000000000000000
x15:
0000000000041400
x14:
5eee00201100200a
x13:
000000000000bb03
x12:
0000000000000000
x11:
0000000000000100
x10:
0200000000000000
x9 :
bb0000021a162c01
x8 :
0302010021021003
x7 :
0000000000000000
x6 :
ffff800012573af0
x5 :
0000000000000001
x4 :
0000000000000001
x3 :
0000000000000200
x2 :
0000000000000348
x1 :
0000000000000348
x0 :
ffff80001095308c
Call trace:
pm_runtime_drop_link+0x128/0x338
ufshpb_get_dev_info+0x8c/0x148
ufshcd_probe_hba+0xda0/0x11b8
ufshcd_async_scan+0x34/0x330
async_run_entry_fn+0x38/0x180
process_one_work+0x1f4/0x498
worker_thread+0x48/0x480
kthread+0x140/0x158
ret_from_fork+0x10/0x20
Code:
88027c01
35ffffa2
17fff6c4
f9800051
(
885f7c40
)
---[ end trace
2ba541335f595c95
]
ufshpb_get_dev_info() is only called during asynchronous scanning and at
that time pm_runtime_get_sync() has been called:
...
/* Hold auto suspend until async scan completes */
pm_runtime_get_sync(dev);
atomic_set(&hba->scsi_block_reqs_cnt, 0);
...
ufshcd_async_scan()
ufshcd_probe_hba(hba, true);
ufshcd_device_params_init(hba);
ufshpb_get_dev_info();
...
pm_runtime_put_sync(hba->dev);
Remove ufshcd_rpm_{get/put}_sync() from ufshpb_get_dev_info() to fix this
problem.
Link:
https://lore.kernel.org/r/20210929200640.828611-2-huobean@gmail.com
Fixes:
351b3a849ac7
("scsi: ufs: ufshpb: Use proper power management API")
Signed-off-by: Bean Huo <beanhuo@micron.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
drivers/scsi/ufs/ufshpb.c
patch
|
blob
|
history
diff --git
a/drivers/scsi/ufs/ufshpb.c
b/drivers/scsi/ufs/ufshpb.c
index
9ea639b
..
33a38c0
100644
(file)
--- a/
drivers/scsi/ufs/ufshpb.c
+++ b/
drivers/scsi/ufs/ufshpb.c
@@
-2877,11
+2877,8
@@
void ufshpb_get_dev_info(struct ufs_hba *hba, u8 *desc_buf)
if (version == HPB_SUPPORT_LEGACY_VERSION)
hpb_dev_info->is_legacy = true;
- ufshcd_rpm_get_sync(hba);
ret = ufshcd_query_attr_retry(hba, UPIU_QUERY_OPCODE_READ_ATTR,
QUERY_ATTR_IDN_MAX_HPB_SINGLE_CMD, 0, 0, &max_hpb_single_cmd);
- ufshcd_rpm_put_sync(hba);
-
if (ret)
dev_err(hba->dev, "%s: idn: read max size of single hpb cmd query request failed",
__func__);