android/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

BACKPORT: scsi: ufs: Fix device management cmd timeout flow

Browse Source 
In the UFS error handling flow, the host will send a device management
cmd(NOP OUT) to the device for link recovery. If this cmd times out and
clearing the doorbell fails, ufshcd_wait_for_dev_cmd() will do nothing
andreturn. hba->dev_cmd.complete struct is not set to NULL.

When this happens, if cmd has been completed by device, then we will
call complete() in __ufshcd_transfer_req_compl(). Because the complete
struct is allocated on the stack, the following crash will occur:

   ipanic_die+0x24/0x38 [mrdump]
   die+0x344/0x748
   arm64_notify_die+0x44/0x104
   do_debug_exception+0x104/0x1e0
   el1_dbg+0x38/0x54
   el1_sync_handler+0x40/0x88
   el1_sync+0x8c/0x140
   queued_spin_lock_slowpath+0x2e4/0x3c0
   __ufshcd_transfer_req_compl+0x3b0/0x1164
   ufshcd_trc_handler+0x15c/0x308
   ufshcd_host_reset_and_restore+0x54/0x260
   ufshcd_reset_and_restore+0x28c/0x57c
   ufshcd_err_handler+0xeb8/0x1b6c
   process_one_work+0x288/0x964
   worker_thread+0x4bc/0xc7c
   kthread+0x15c/0x264
   ret_from_fork+0x10/0x30

Bug:280957963
Change-Id: I1529c332847ace10bf4a6f8c1ec10ea2eb1eea6a
(cherry picked from commit 36822124f9de200cedc2f42516301b50d386a6cd)
Link: https://lore.kernel.org/r/20221216032532.1280-1-mason.zhang@mediatek.com
Signed-off-by: Mason Zhang <Mason.Zhang@mediatek.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: tanghuan <tanghuan@vivo.com>
This commit is contained in:
tanghuan 2023-05-16 17:28:21 +08:00 committed by Todd Kjos
parent 3641f511ee
commit c28be8ff1d
1 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
drivers/scsi/ufs/ufshcd.c
View File

@ -2926,6 +2926,21 @@ static int ufshcd_wait_for_dev_cmd(struct ufs_hba *hba,
} else {
dev_err(hba->dev, "%s: failed to clear tag %d\n",
__func__, lrbp->task_tag);
spin_lock_irqsave(hba->host->host_lock, flags);
pending = test_bit(lrbp->task_tag,
&hba->outstanding_reqs);
if (pending)
hba->dev_cmd.complete = NULL;
spin_unlock_irqrestore(hba->host->host_lock, flags);
if (!pending) {
/*
* The completion handler ran while we tried to
* clear the command.
*/
time_left = 1;
goto retry;
}
}
}