scsi: ufs: Remove ufshcd_valid_tag()

scsi_add_host() allocates shost->can_queue tags. ufshcd_init() sets
shost->can_queue to hba->nutrs. In other words, we know that tag values
will less than hba->nutrs. Hence remove the checks that verify that
blk_get_request() returns a tag less than hba->nutrs. This check was
introduced by commit 14497328b6a6 ("scsi: ufs: verify command tag
validity").

Keep the tag >= 0 check because it helps to detect use-after-free issues.

Link: https://lore.kernel.org/r/20210722033439.26550-7-bvanassche@acm.org
CC: Avri Altman <avri.altman@wdc.com>
Cc: Alim Akhtar <alim.akhtar@samsung.com>
Reviewed-by: Bean Huo <beanhuo@micron.com>
Reviewed-by: Daejun Park <daejun7.park@samsung.com>
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index 77d705e..17ef4ce 100644 (file)
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -253,11 +253,6 @@ static inline void ufshcd_wb_toggle_flush(struct ufs_hba *hba, bool enable);
 static void ufshcd_hba_vreg_set_lpm(struct ufs_hba *hba);
 static void ufshcd_hba_vreg_set_hpm(struct ufs_hba *hba);
 
-static inline bool ufshcd_valid_tag(struct ufs_hba *hba, int tag)
-{
-       return tag >= 0 && tag < hba->nutrs;
-}
-
 static inline void ufshcd_enable_irq(struct ufs_hba *hba)
 {
        if (!hba->is_irq_enabled) {
@@ -2701,20 +2696,12 @@ static void ufshcd_init_lrb(struct ufs_hba *hba, struct ufshcd_lrb *lrb, int i)
  */
 static int ufshcd_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *cmd)
 {
+       struct ufs_hba *hba = shost_priv(host);
+       int tag = cmd->request->tag;
        struct ufshcd_lrb *lrbp;
-       struct ufs_hba *hba;
-       int tag;
        int err = 0;
 
-       hba = shost_priv(host);
-
-       tag = cmd->request->tag;
-       if (!ufshcd_valid_tag(hba, tag)) {
-               dev_err(hba->dev,
-                       "%s: invalid command tag %d: cmd=0x%p, cmd->request=0x%p",
-                       __func__, tag, cmd, cmd->request);
-               BUG();
-       }
+       WARN_ONCE(tag < 0, "Invalid tag %d\n", tag);
 
        if (!down_read_trylock(&hba->clk_scaling_lock))
                return SCSI_MLQUEUE_HOST_BUSY;
@@ -2975,7 +2962,7 @@ static int ufshcd_exec_dev_cmd(struct ufs_hba *hba,
                goto out_unlock;
        }
        tag = req->tag;
-       WARN_ON_ONCE(!ufshcd_valid_tag(hba, tag));
+       WARN_ONCE(tag < 0, "Invalid tag %d\n", tag);
        /* Set the timeout such that the SCSI error handler is not activated. */
        req->timeout = msecs_to_jiffies(2 * timeout);
        blk_mq_start_request(req);
@@ -6713,7 +6700,7 @@ static int ufshcd_issue_devman_upiu_cmd(struct ufs_hba *hba,
                goto out_unlock;
        }
        tag = req->tag;
-       WARN_ON_ONCE(!ufshcd_valid_tag(hba, tag));
+       WARN_ONCE(tag < 0, "Invalid tag %d\n", tag);
 
        if (unlikely(test_bit(tag, &hba->outstanding_reqs))) {
                err = -EBUSY;
@@ -7015,24 +7002,15 @@ out:
  */
 static int ufshcd_abort(struct scsi_cmnd *cmd)
 {
-       struct Scsi_Host *host;
-       struct ufs_hba *hba;
+       struct Scsi_Host *host = cmd->device->host;
+       struct ufs_hba *hba = shost_priv(host);
+       unsigned int tag = cmd->request->tag;
+       struct ufshcd_lrb *lrbp = &hba->lrb[tag];
        unsigned long flags;
-       unsigned int tag;
        int err = 0;
-       struct ufshcd_lrb *lrbp;
        u32 reg;
 
-       host = cmd->device->host;
-       hba = shost_priv(host);
-       tag = cmd->request->tag;
-       lrbp = &hba->lrb[tag];
-       if (!ufshcd_valid_tag(hba, tag)) {
-               dev_err(hba->dev,
-                       "%s: invalid command tag %d: cmd=0x%p, cmd->request=0x%p",
-                       __func__, tag, cmd, cmd->request);
-               BUG();
-       }
+       WARN_ONCE(tag < 0, "Invalid tag %d\n", tag);
 
        ufshcd_hold(hba, false);
        reg = ufshcd_readl(hba, REG_UTP_TRANSFER_REQ_DOOR_BELL);