evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

scsi: ufs: fix NULL pointer dereference when aborting command

Browse source 
If there is a race between command completion and the scsi timeout,
the scsi timeout ignores the command completion and proceed with
aborting the command. Since the command completion happen in
interrupt context, it would be prioritized and ufshcd might free
resources before abort initiated by scsi is completed. Hence, if the
abort routine refers to the command info saved in lrbp it would cause
NULL pointer dereference. Fix this by using the command info provided
by scsi layer in the ufshcd_abort() argument.

Change-Id: Ie915880b1c239ef9080cfb5cb74f19329b3a82d4
Signed-off-by: Sujit Reddy Thumma <sthumma@codeaurora.org>
This commit is contained in:
Sujit Reddy Thumma 2013-11-22 09:39:34 +05:30 • committed by David Keitel
parent 953a9f7f36
commit ada4c78516
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
drivers/scsi/ufs/ufshcd.c
View file

@ -4090,7 +4090,7 @@ static int ufshcd_abort(struct scsi_cmnd *cmd)
/* Print Transfer Request of aborted task */
dev_err(hba->dev, "%s: Device abort task at tag %d", __func__, tag);
scsi_print_command(hba->lrb[tag].cmd);
scsi_print_command(cmd);
ufshcd_print_host_regs(hba);
ufshcd_print_trs(hba, 1 << tag, true);