mirror of
https://github.com/torvalds/linux
synced 2024-10-19 17:58:44 +00:00
cfcbae3895
In function __ufshcd_query_descriptor(), in the event of an error happening, we directly goto out_unlock and forget to invaliate hba->dev_cmd.query.descriptor pointer. This results in this pointer still valid in ufshcd_copy_query_response() for other query requests which go through ufshcd_exec_raw_upiu_cmd(). This will cause __memcpy() crash and system hangs. Log as shown below: Unable to handle kernel paging request at virtual address ffff000012233c40 Mem abort info: ESR = 0x96000047 Exception class = DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 Data abort info: ISV = 0, ISS = 0x00000047 CM = 0, WnR = 1 swapper pgtable: 4k pages, 48-bit VAs, pgdp = 0000000028cc735c [ffff000012233c40] pgd=00000000bffff003, pud=00000000bfffe003, pmd=00000000ba8b8003, pte=0000000000000000 Internal error: Oops: 96000047 [#2] PREEMPT SMP ... Call trace: __memcpy+0x74/0x180 ufshcd_issue_devman_upiu_cmd+0x250/0x3c0 ufshcd_exec_raw_upiu_cmd+0xfc/0x1a8 ufs_bsg_request+0x178/0x3b0 bsg_queue_rq+0xc0/0x118 blk_mq_dispatch_rq_list+0xb0/0x538 blk_mq_sched_dispatch_requests+0x18c/0x1d8 __blk_mq_run_hw_queue+0xb4/0x118 blk_mq_run_work_fn+0x28/0x38 process_one_work+0x1ec/0x470 worker_thread+0x48/0x458 kthread+0x130/0x138 ret_from_fork+0x10/0x1c Code: 540000ab a8c12027 a88120c7 a8c12027 (a88120c7) ---[ end trace 793e1eb5dff69f2d ]--- note: kworker/0:2H[2054] exited with preempt_count 1 This patch is to move "descriptor = NULL" down to below the label "out_unlock". Fixes: d44a5f98bb49b2(ufs: query descriptor API) Link: https://lore.kernel.org/r/20191112223436.27449-3-huobean@gmail.com Reviewed-by: Alim Akhtar <alim.akhtar@samsung.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Bean Huo <beanhuo@micron.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> |
||
|---|---|---|
| .. | ||
| cdns-pltfrm.c | ||
| Kconfig | ||
| Makefile | ||
| tc-dwc-g210-pci.c | ||
| tc-dwc-g210-pltfrm.c | ||
| tc-dwc-g210.c | ||
| tc-dwc-g210.h | ||
| ti-j721e-ufs.c | ||
| ufs-hisi.c | ||
| ufs-hisi.h | ||
| ufs-mediatek.c | ||
| ufs-mediatek.h | ||
| ufs-qcom.c | ||
| ufs-qcom.h | ||
| ufs-sysfs.c | ||
| ufs-sysfs.h | ||
| ufs.h | ||
| ufs_bsg.c | ||
| ufs_bsg.h | ||
| ufs_quirks.h | ||
| ufshcd-dwc.c | ||
| ufshcd-dwc.h | ||
| ufshcd-pci.c | ||
| ufshcd-pltfrm.c | ||
| ufshcd-pltfrm.h | ||
| ufshcd.c | ||
| ufshcd.h | ||
| ufshci-dwc.h | ||
| ufshci.h | ||
| unipro.h | ||