• Bean Huo's avatar
    scsi: ufs: core: Fix NULL pointer dereference · 1da3b014
    Bean Huo authored
    Calling ufshcd_rpm_{get/put}_sync() prior to ufshcd_scsi_add_wlus() being
    called will trigger a NULL pointer dereference. This is because
    hba->sdev_ufs_device is initialized in ufshcd_scsi_add_wlus().
    
        Unable to handle kernel NULL pointer dereference at virtual address
        0000000000000348
        Mem abort info:
          ESR = 0x96000004
          EC = 0x25: DABT (current EL), IL = 32 bits
          SET = 0, FnV = 0
          EA = 0, S1PTW = 0
          FSC = 0x04: level 0 translation fault
        Data abort info:
          ISV = 0, ISS = 0x00000004
          CM = 0, WnR = 0
        [0000000000000348] user address but active_mm is swapper
        Internal error: Oops: 96000004 [#1] PREEMPT SMP
        Modules linked in:
        CPU: 0 PID: 91 Comm: kworker/u16:1 Not tainted 5.15.0-rc1-beanhuo-linaro-1423
        Hardware name: MicronRB (DT)
        Workqueue: events_unbound async_run_entry_fn
        pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
        pc : pm_runtime_drop_link+0x128/0x338
        lr : ufshpb_get_dev_info+0x8c/0x148
        sp : ffff800012573c10
        x29: ffff800012573c10 x28: 0000000000000000 x27: 0000000000000003
        x26: ffff000001d21298 x25: 000000005abcea60 x24: ffff800011d89000
        x23: 0000000000000001 x22: ffff000001d21880 x21: ffff000001ec9300
        x20: 0000000000000004 x19: 0000000000000198 x18: ffffffffffffffff
        x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000041400
        x14: 5eee00201100200a x13: 000000000000bb03 x12: 0000000000000000
        x11: 0000000000000100 x10: 0200000000000000 x9 : bb0000021a162c01
        x8 : 0302010021021003 x7 : 0000000000000000 x6 : ffff800012573af0
        x5 : 0000000000000001 x4 : 0000000000000001 x3 : 0000000000000200
        x2 : 0000000000000348 x1 : 0000000000000348 x0 : ffff80001095308c
        Call trace:
         pm_runtime_drop_link+0x128/0x338
         ufshpb_get_dev_info+0x8c/0x148
         ufshcd_probe_hba+0xda0/0x11b8
         ufshcd_async_scan+0x34/0x330
         async_run_entry_fn+0x38/0x180
         process_one_work+0x1f4/0x498
         worker_thread+0x48/0x480
         kthread+0x140/0x158
         ret_from_fork+0x10/0x20
        Code: 88027c01 35ffffa2 17fff6c4 f9800051 (885f7c40)
        ---[ end trace 2ba541335f595c95 ]
    
    ufshpb_get_dev_info() is only called during asynchronous scanning and at
    that time pm_runtime_get_sync() has been called:
    
        ...
        /* Hold auto suspend until async scan completes */
        pm_runtime_get_sync(dev);
        atomic_set(&hba->scsi_block_reqs_cnt, 0);
        ...
        ufshcd_async_scan()
            ufshcd_probe_hba(hba, true);
                ufshcd_device_params_init(hba);
                    ufshpb_get_dev_info();
        ...
            pm_runtime_put_sync(hba->dev);
    
    Remove ufshcd_rpm_{get/put}_sync() from ufshpb_get_dev_info() to fix this
    problem.
    
    Link: https://lore.kernel.org/r/20210929200640.828611-2-huobean@gmail.com
    Fixes: 351b3a84 ("scsi: ufs: ufshpb: Use proper power management API")
    Signed-off-by: default avatarBean Huo <beanhuo@micron.com>
    Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
    1da3b014
ufshpb.c 71.1 KB