From: Sasha Levin <sashal@kernel.org> To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Mason Zhang <Mason.Zhang@mediatek.com>, Bart Van Assche <bvanassche@acm.org>, "Martin K . Petersen" <martin.petersen@oracle.com>, Sasha Levin <sashal@kernel.org>, jejb@linux.ibm.com, matthias.bgg@gmail.com, beanhuo@micron.com, avri.altman@wdc.com, stanley.chu@mediatek.com, quic_asutoshd@quicinc.com, linux-scsi@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-mediatek@lists.infradead.org Subject: [PATCH AUTOSEL 6.1 47/58] scsi: ufs: core: Fix device management cmd timeout flow Date: Sun, 26 Feb 2023 21:04:45 -0500 [thread overview] Message-ID: <20230227020457.1048737-47-sashal@kernel.org> (raw) In-Reply-To: <20230227020457.1048737-1-sashal@kernel.org> From: Mason Zhang <Mason.Zhang@mediatek.com> [ Upstream commit 36822124f9de200cedc2f42516301b50d386a6cd ] In the UFS error handling flow, the host will send a device management cmd (NOP OUT) to the device for link recovery. If this cmd times out and clearing the doorbell fails, ufshcd_wait_for_dev_cmd() will do nothing and return. hba->dev_cmd.complete struct is not set to NULL. When this happens, if cmd has been completed by device, then we will call complete() in __ufshcd_transfer_req_compl(). Because the complete struct is allocated on the stack, the following crash will occur: ipanic_die+0x24/0x38 [mrdump] die+0x344/0x748 arm64_notify_die+0x44/0x104 do_debug_exception+0x104/0x1e0 el1_dbg+0x38/0x54 el1_sync_handler+0x40/0x88 el1_sync+0x8c/0x140 queued_spin_lock_slowpath+0x2e4/0x3c0 __ufshcd_transfer_req_compl+0x3b0/0x1164 ufshcd_trc_handler+0x15c/0x308 ufshcd_host_reset_and_restore+0x54/0x260 ufshcd_reset_and_restore+0x28c/0x57c ufshcd_err_handler+0xeb8/0x1b6c process_one_work+0x288/0x964 worker_thread+0x4bc/0xc7c kthread+0x15c/0x264 ret_from_fork+0x10/0x30 Link: https://lore.kernel.org/r/20221216032532.1280-1-mason.zhang@mediatek.com Signed-off-by: Mason Zhang <Mason.Zhang@mediatek.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org> --- drivers/ufs/core/ufshcd.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c index fb5c9e2fc5348..dae49530201bf 100644 --- a/drivers/ufs/core/ufshcd.c +++ b/drivers/ufs/core/ufshcd.c @@ -3006,6 +3006,22 @@ static int ufshcd_wait_for_dev_cmd(struct ufs_hba *hba, } else { dev_err(hba->dev, "%s: failed to clear tag %d\n", __func__, lrbp->task_tag); + + spin_lock_irqsave(&hba->outstanding_lock, flags); + pending = test_bit(lrbp->task_tag, + &hba->outstanding_reqs); + if (pending) + hba->dev_cmd.complete = NULL; + spin_unlock_irqrestore(&hba->outstanding_lock, flags); + + if (!pending) { + /* + * The completion handler ran while we tried to + * clear the command. + */ + time_left = 1; + goto retry; + } } } -- 2.39.0
WARNING: multiple messages have this Message-ID (diff)
From: Sasha Levin <sashal@kernel.org> To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Mason Zhang <Mason.Zhang@mediatek.com>, Bart Van Assche <bvanassche@acm.org>, "Martin K . Petersen" <martin.petersen@oracle.com>, Sasha Levin <sashal@kernel.org>, jejb@linux.ibm.com, matthias.bgg@gmail.com, beanhuo@micron.com, avri.altman@wdc.com, stanley.chu@mediatek.com, quic_asutoshd@quicinc.com, linux-scsi@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-mediatek@lists.infradead.org Subject: [PATCH AUTOSEL 6.1 47/58] scsi: ufs: core: Fix device management cmd timeout flow Date: Sun, 26 Feb 2023 21:04:45 -0500 [thread overview] Message-ID: <20230227020457.1048737-47-sashal@kernel.org> (raw) In-Reply-To: <20230227020457.1048737-1-sashal@kernel.org> From: Mason Zhang <Mason.Zhang@mediatek.com> [ Upstream commit 36822124f9de200cedc2f42516301b50d386a6cd ] In the UFS error handling flow, the host will send a device management cmd (NOP OUT) to the device for link recovery. If this cmd times out and clearing the doorbell fails, ufshcd_wait_for_dev_cmd() will do nothing and return. hba->dev_cmd.complete struct is not set to NULL. When this happens, if cmd has been completed by device, then we will call complete() in __ufshcd_transfer_req_compl(). Because the complete struct is allocated on the stack, the following crash will occur: ipanic_die+0x24/0x38 [mrdump] die+0x344/0x748 arm64_notify_die+0x44/0x104 do_debug_exception+0x104/0x1e0 el1_dbg+0x38/0x54 el1_sync_handler+0x40/0x88 el1_sync+0x8c/0x140 queued_spin_lock_slowpath+0x2e4/0x3c0 __ufshcd_transfer_req_compl+0x3b0/0x1164 ufshcd_trc_handler+0x15c/0x308 ufshcd_host_reset_and_restore+0x54/0x260 ufshcd_reset_and_restore+0x28c/0x57c ufshcd_err_handler+0xeb8/0x1b6c process_one_work+0x288/0x964 worker_thread+0x4bc/0xc7c kthread+0x15c/0x264 ret_from_fork+0x10/0x30 Link: https://lore.kernel.org/r/20221216032532.1280-1-mason.zhang@mediatek.com Signed-off-by: Mason Zhang <Mason.Zhang@mediatek.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org> --- drivers/ufs/core/ufshcd.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c index fb5c9e2fc5348..dae49530201bf 100644 --- a/drivers/ufs/core/ufshcd.c +++ b/drivers/ufs/core/ufshcd.c @@ -3006,6 +3006,22 @@ static int ufshcd_wait_for_dev_cmd(struct ufs_hba *hba, } else { dev_err(hba->dev, "%s: failed to clear tag %d\n", __func__, lrbp->task_tag); + + spin_lock_irqsave(&hba->outstanding_lock, flags); + pending = test_bit(lrbp->task_tag, + &hba->outstanding_reqs); + if (pending) + hba->dev_cmd.complete = NULL; + spin_unlock_irqrestore(&hba->outstanding_lock, flags); + + if (!pending) { + /* + * The completion handler ran while we tried to + * clear the command. + */ + time_left = 1; + goto retry; + } } } -- 2.39.0 _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
next prev parent reply other threads:[~2023-02-27 2:36 UTC|newest] Thread overview: 115+ messages / expand[flat|nested] mbox.gz Atom feed top 2023-02-27 2:03 [PATCH AUTOSEL 6.1 01/58] drm: panel-orientation-quirks: Add quirk for Lenovo Yoga Tab 3 X90F Sasha Levin 2023-02-27 2:03 ` Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 02/58] drm: panel-orientation-quirks: Add quirk for DynaBook K50 Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 03/58] drm/amd/display: Reduce expected sdp bandwidth for dcn321 Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 04/58] drm/amd/display: Revert Reduce delay when sink device not able to ACK 00340h write Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 05/58] drm/amd/display: Fix potential null-deref in dm_resume Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 06/58] drm/omap: dsi: Fix excessive stack usage Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 07/58] HID: Add Mapping for System Microphone Mute Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 08/58] drm/tiny: ili9486: Do not assume 8-bit only SPI controllers Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 09/58] drm/amd/display: Defer DIG FIFO disable after VID stream enable Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 10/58] drm/radeon: free iio for atombios when driver shutdown Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 11/58] drm/amd: Avoid BUG() for case of SRIOV missing IP version Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 12/58] drm/amdkfd: Page aligned memory reserve size Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 13/58] scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 14/58] Revert "fbcon: don't lose the console font across generic->chip driver switch" Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 15/58] drm/amd: Avoid ASSERT for some message failures Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 16/58] drm: amd: display: Fix memory leakage Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 17/58] drm/amd/display: fix mapping to non-allocated address Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 18/58] drm/msm/dp: Remove INIT_SETUP delay Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 9:12 ` Johan Hovold 2023-02-27 9:12 ` Johan Hovold 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 19/58] HID: uclogic: Add frame type quirk Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 20/58] HID: uclogic: Add battery quirk Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 21/58] HID: uclogic: Add support for XP-PEN Deco Pro SW Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 22/58] HID: uclogic: Add support for XP-PEN Deco Pro MW Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 23/58] HID: multitouch: Add quirks for flipped axes Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 24/58] drm/msm/dsi: Add missing check for alloc_ordered_workqueue Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 25/58] drm: rcar-du: Add quirk for H3 ES1.x pclk workaround Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 26/58] drm: rcar-du: Fix setting a reserved bit in DPLLCR Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 27/58] drm/drm_print: correct format problem Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 28/58] drm/amd/display: Set hvm_enabled flag for S/G mode Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 29/58] habanalabs: extend fatal messages to contain PCI info Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 30/58] habanalabs: fix bug in timestamps registration code Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 31/58] docs/scripts/gdb: add necessary make scripts_gdb step Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 32/58] drm/msm/dpu: Add DSC hardware blocks to register snapshot Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 33/58] ASoC: soc-compress: Reposition and add pcm_mutex Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 34/58] ASoC: kirkwood: Iterate over array indexes instead of using pointer math Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 35/58] regulator: max77802: Bounds check regulator id against opmode Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 36/58] regulator: s5m8767: Bounds check id indexing into arrays Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 37/58] Revert "drm/amdgpu: TA unload messages are not actually sent to psp when amdgpu is uninstalled" Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 38/58] drm/amd/display: fix FCLK pstate change underflow Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 39/58] gfs2: Improve gfs2_make_fs_rw error handling Sasha Levin 2023-02-27 2:04 ` [Cluster-devel] " Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 40/58] hwmon: (coretemp) Simplify platform device handling Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 41/58] hwmon: (nct6775) Directly call ASUS ACPI WMI method Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 42/58] hwmon: (nct6775) B650/B660/X670 ASUS boards support Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 43/58] pinctrl: at91: use devm_kasprintf() to avoid potential leaks Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 44/58] drm/amd/display: Do not set DRR on pipe commit Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 45/58] drm/amd/display: Do not commit pipe when updating DRR Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 46/58] scsi: snic: Fix memory leak with using debugfs_lookup() Sasha Levin 2023-02-27 2:04 ` Sasha Levin [this message] 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 47/58] scsi: ufs: core: Fix device management cmd timeout flow Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 48/58] HID: logitech-hidpp: Don't restart communication if not necessary Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 49/58] drm/amd/display: Move DCN314 DOMAIN power control to DMCUB Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 50/58] drm/amd/display: Enable P-state validation checks for DCN314 Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 51/58] drm: panel-orientation-quirks: Add quirk for Lenovo IdeaPad Duet 3 10IGL5 Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 52/58] drm/amd/display: Disable HUBP/DPP PG on DCN314 for now Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` [dm-devel] [PATCH AUTOSEL 6.1 53/58] dm thin: add cond_resched() to various workqueue loops Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` [dm-devel] [PATCH AUTOSEL 6.1 54/58] dm cache: " Sasha Levin 2023-02-27 2:04 ` Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 55/58] nfsd: zero out pointers after putting nfsd_files on COPY setup error Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 56/58] nfsd: clean up potential nfsd_file refcount leaks in COPY codepath Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 57/58] nfsd: don't hand out delegation on setuid files being opened for write Sasha Levin 2023-02-27 2:04 ` [PATCH AUTOSEL 6.1 58/58] cifs: prevent data race in smb2_reconnect() Sasha Levin
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20230227020457.1048737-47-sashal@kernel.org \ --to=sashal@kernel.org \ --cc=Mason.Zhang@mediatek.com \ --cc=avri.altman@wdc.com \ --cc=beanhuo@micron.com \ --cc=bvanassche@acm.org \ --cc=jejb@linux.ibm.com \ --cc=linux-arm-kernel@lists.infradead.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-mediatek@lists.infradead.org \ --cc=linux-scsi@vger.kernel.org \ --cc=martin.petersen@oracle.com \ --cc=matthias.bgg@gmail.com \ --cc=quic_asutoshd@quicinc.com \ --cc=stable@vger.kernel.org \ --cc=stanley.chu@mediatek.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.