Prevent that both the interrupt handler and the reset handler try to complete a request at the same time. This patch is the result of an analysis of the following crash: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000120 CPU: 0 PID: 0 Comm: swapper/0 Tainted: G OE 5.10.107-android13-4-00051-g1e48e8970cca-ab8664745 #1 pc : ufshcd_release_scsi_cmd+0x30/0x46c lr : __ufshcd_transfer_req_compl+0x4fc/0x9c0 Call trace: ufshcd_release_scsi_cmd+0x30/0x46c __ufshcd_transfer_req_compl+0x4fc/0x9c0 ufshcd_poll+0xf0/0x208 ufshcd_sl_intr+0xb8/0xf0 ufshcd_intr+0x168/0x2f4 __handle_irq_event_percpu+0xa0/0x30c handle_irq_event+0x84/0x178 handle_fasteoi_irq+0x150/0x2e8 __handle_domain_irq+0x114/0x1e4 gic_handle_irq.31846+0x58/0x300 el1_irq+0xe4/0x1c0 cpuidle_enter_state+0x3ac/0x8c4 do_idle+0x2fc/0x55c cpu_startup_entry+0x84/0x90 kernel_init+0x0/0x310 start_kernel+0x0/0x608 start_kernel+0x4ec/0x608
Unified · Split
| @@ -6968,14 +6968,14 @@ int ufshcd_exec_raw_upiu_cmd(struct ufs_hba *hba, · 6967 unmodified lines | |||
| 6968 | } | 6968 | } |
| 6969 | 6969 | ||
| 6970 | /** | 6970 | /** |
| 6971 | * ufshcd_eh_device_reset_handler - device reset handler registered to | 6971 | * ufshcd_eh_device_reset_handler() - Reset a single logical unit. |
| 6972 | * scsi layer. | ||
| 6973 | * @cmd: SCSI command pointer | 6972 | * @cmd: SCSI command pointer |
| 6974 | * | 6973 | * |
| 6975 | * Returns SUCCESS/FAILED | 6974 | * Returns SUCCESS/FAILED |
| 6976 | */ | 6975 | */ |
| 6977 | static int ufshcd_eh_device_reset_handler(struct scsi_cmnd *cmd) | 6976 | static int ufshcd_eh_device_reset_handler(struct scsi_cmnd *cmd) |
| 6978 | { | 6977 | { |
| 6978 | unsigned long flags, pending_reqs = 0, not_cleared = 0; | ||
| 6979 | struct Scsi_Host *host; | 6979 | struct Scsi_Host *host; |
| 6980 | struct ufs_hba *hba; | 6980 | struct ufs_hba *hba; |
| 6981 | u32 pos; | 6981 | u32 pos; |
| @@ -6994,14 +6994,24 @@ static int ufshcd_eh_device_reset_handler(struct scsi_cmnd *cmd) · 12 unmodified lines | |||
| 6994 | } | 6994 | } |
| 6995 | 6995 | ||
| 6996 | /* clear the commands that were pending for corresponding LUN */ | 6996 | /* clear the commands that were pending for corresponding LUN */ |
| 6997 | for_each_set_bit(pos, &hba->outstanding_reqs, hba->nutrs) { | 6997 | spin_lock_irqsave(&hba->outstanding_lock, flags); |
| 6998 | if (hba->lrb[pos].lun == lun) { | 6998 | for_each_set_bit(pos, &hba->outstanding_reqs, hba->nutrs) |
| 6999 | err = ufshcd_clear_cmds(hba, 1U << pos); | 6999 | if (hba->lrb[pos].lun == lun) |
| 7000 | if (err) | 7000 | __set_bit(pos, &pending_reqs); |
| 7001 | break; | 7001 | hba->outstanding_reqs &= ~pending_reqs; |
| 7002 | __ufshcd_transfer_req_compl(hba, 1U << pos); | 7002 | spin_unlock_irqrestore(&hba->outstanding_lock, flags); |
| 7003 | } | 7003 | |
| 7004 | if (ufshcd_clear_cmds(hba, pending_reqs) < 0) { | ||
| 7005 | spin_lock_irqsave(&hba->outstanding_lock, flags); | ||
| 7006 | not_cleared = pending_reqs & | ||
| 7007 | ufshcd_readl(hba, REG_UTP_TRANSFER_REQ_DOOR_BELL); | ||
| 7008 | hba->outstanding_reqs |= not_cleared; | ||
| 7009 | spin_unlock_irqrestore(&hba->outstanding_lock, flags); | ||
| 7010 | |||
| 7011 | dev_err(hba->dev, "%s: failed to clear requests %#lx\n", | ||
| 7012 | __func__, not_cleared); | ||
| 7004 | } | 7013 | } |
| 7014 | __ufshcd_transfer_req_compl(hba, pending_reqs & ~not_cleared); | ||
| 7005 | 7015 | ||
| 7006 | out: | 7016 | out: |
| 7007 | hba->req_abort_count = 0; | 7017 | hba->req_abort_count = 0; |