[PATCH v1] ufs: core: fix ufshcd_abort_all racing issue

[Bart Van Assche]

On 6/21/24 4:30 AM, peter.wang at mediatek.com wrote:
 > [ ... ]

Fixes: and Cc: stable tags are missing from this patch. Please add
these.

> diff --git a/drivers/ufs/core/ufs-mcq.c b/drivers/ufs/core/ufs-mcq.c
> index 8944548c30fa..3b2e5bcb08a7 100644
> --- a/drivers/ufs/core/ufs-mcq.c
> +++ b/drivers/ufs/core/ufs-mcq.c
> @@ -512,8 +512,9 @@ int ufshcd_mcq_sq_cleanup(struct ufs_hba *hba, int task_tag)
>   		return -ETIMEDOUT;
>   
>   	if (task_tag != hba->nutrs - UFSHCD_NUM_RESERVED) {
> -		if (!cmd)
> -			return -EINVAL;
> +		/* Should return 0 if cmd is already complete by irq */
> +		if (!cmd || !ufshcd_cmd_inflight(cmd))
> +			return 0;
>   		hwq = ufshcd_mcq_req_to_hwq(hba, scsi_cmd_to_rq(cmd));
>   	} else {
>   		hwq = hba->dev_cmd_queue;

This code change reduces the race window but does not eliminate it since
no locks are held around this code path.

Additionally, are you sure that this change is necessary? I don't think
that ufshcd_err_handler() calls ufshcd_mcq_sq_cleanup().

Thanks,

Bart.