Prevent that both the interrupt handler and the reset handler try to complete a request at the same time. This patch is the result of an analysis of the following crash: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000120 CPU: 0 PID: 0 Comm: swapper/0 Tainted: G OE 5.10.107-android13-4-00051-g1e48e8970cca-ab8664745 #1 pc : ufshcd_release_scsi_cmd+0x30/0x46c lr : __ufshcd_transfer_req_compl+0x4fc/0x9c0 Call trace: ufshcd_release_scsi_cmd+0x30/0x46c __ufshcd_transfer_req_compl+0x4fc/0x9c0 ufshcd_poll+0xf0/0x208 ufshcd_sl_intr+0xb8/0xf0 ufshcd_intr+0x168/0x2f4 __handle_irq_event_percpu+0xa0/0x30c handle_irq_event+0x84/0x178 handle_fasteoi_irq+0x150/0x2e8 __handle_domain_irq+0x114/0x1e4 gic_handle_irq.31846+0x58/0x300 el1_irq+0xe4/0x1c0 cpuidle_enter_state+0x3ac/0x8c4 do_idle+0x2fc/0x55c cpu_startup_entry+0x84/0x90 kernel_init+0x0/0x310 start_kernel+0x0/0x608 start_kernel+0x4ec/0x608
Unified · Split
| @@ -6968,14 +6968,14 @@ int ufshcd_exec_raw_upiu_cmd(struct ufs_hba *hba, · 6967 unmodified lines | ||
| 6968 | 6968 | } |
| 6969 | 6969 | |
| 6970 | 6970 | /** |
| 6971 | − * ufshcd_eh_device_reset_handler - device reset handler registered to | |
| 6972 | − * scsi layer. | |
| 6971 | + * ufshcd_eh_device_reset_handler() - Reset a single logical unit. | |
| 6973 | 6972 | * @cmd: SCSI command pointer |
| 6974 | 6973 | * |
| 6975 | 6974 | * Returns SUCCESS/FAILED |
| 6976 | 6975 | */ |
| 6977 | 6976 | static int ufshcd_eh_device_reset_handler(struct scsi_cmnd *cmd) |
| 6978 | 6977 | { |
| 6978 | + unsigned long flags, pending_reqs = 0, not_cleared = 0; | |
| 6979 | 6979 | struct Scsi_Host *host; |
| 6980 | 6980 | struct ufs_hba *hba; |
| 6981 | 6981 | u32 pos; |
| @@ -6994,14 +6994,24 @@ static int ufshcd_eh_device_reset_handler(struct scsi_cmnd *cmd) · 12 unmodified lines | ||
| 6994 | 6994 | } |
| 6995 | 6995 | |
| 6996 | 6996 | /* clear the commands that were pending for corresponding LUN */ |
| 6997 | − for_each_set_bit(pos, &hba->outstanding_reqs, hba->nutrs) { | |
| 6998 | − if (hba->lrb[pos].lun == lun) { | |
| 6999 | − err = ufshcd_clear_cmds(hba, 1U << pos); | |
| 7000 | − if (err) | |
| 7001 | − break; | |
| 7002 | − __ufshcd_transfer_req_compl(hba, 1U << pos); | |
| 7003 | − } | |
| 6997 | + spin_lock_irqsave(&hba->outstanding_lock, flags); | |
| 6998 | + for_each_set_bit(pos, &hba->outstanding_reqs, hba->nutrs) | |
| 6999 | + if (hba->lrb[pos].lun == lun) | |
| 7000 | + __set_bit(pos, &pending_reqs); | |
| 7001 | + hba->outstanding_reqs &= ~pending_reqs; | |
| 7002 | + spin_unlock_irqrestore(&hba->outstanding_lock, flags); | |
| 7003 | + | |
| 7004 | + if (ufshcd_clear_cmds(hba, pending_reqs) < 0) { | |
| 7005 | + spin_lock_irqsave(&hba->outstanding_lock, flags); | |
| 7006 | + not_cleared = pending_reqs & | |
| 7007 | + ufshcd_readl(hba, REG_UTP_TRANSFER_REQ_DOOR_BELL); | |
| 7008 | + hba->outstanding_reqs |= not_cleared; | |
| 7009 | + spin_unlock_irqrestore(&hba->outstanding_lock, flags); | |
| 7010 | + | |
| 7011 | + dev_err(hba->dev, "%s: failed to clear requests %#lx\n", | |
| 7012 | + __func__, not_cleared); | |
| 7004 | 7013 | } |
| 7014 | + __ufshcd_transfer_req_compl(hba, pending_reqs & ~not_cleared); | |
| 7005 | 7015 | |
| 7006 | 7016 | out: |
| 7007 | 7017 | hba->req_abort_count = 0; |