[PATCH] scsi: ufs: ufs-pci: Check hba->vops in system PM callbacks

[PATCH] scsi: ufs: ufs-pci: Check hba->vops in system PM callbacks

[Stanley Jhu]

ufshcd_pci_tbl[] defines the Samsung 0xC00C and AMD 0x1B29 PCI IDs
with .driver_data set to 0, so ufshcd_pci_probe() leaves hba->vops
NULL. Both ufshcd_pci_suspend_prepare() and
ufshcd_pci_resume_complete() dereference hba->vops->name without
checking hba->vops:

1. System suspend on an AMD 0x1B29 or Samsung 0xC00C host enters the
   PM prepare phase and calls ufshcd_pci_suspend_prepare().
2. ufshcd_pci_suspend_prepare() evaluates
   strcmp(hba->vops->name, "intel-pci"), dereferences NULL, and
   triggers a kernel oops in the suspending task.

Check that hba->vops is non-NULL before reading hba->vops->name in
both callbacks so hosts without variant operations use the generic
ufshcd_suspend_prepare() and ufshcd_resume_complete() paths.

Fixes: bb44826c3bdb ("scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers")
Cc: stable@vger.kernel.org
Signed-off-by: Stanley Jhu <stanleyjhu@google.com>
---
 drivers/ufs/host/ufshcd-pci.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/ufs/host/ufshcd-pci.c b/drivers/ufs/host/ufshcd-pci.c
index 668b57403e62..f9abbbc436f4 100644
--- a/drivers/ufs/host/ufshcd-pci.c
+++ b/drivers/ufs/host/ufshcd-pci.c
@@ -644,7 +644,7 @@ static int ufshcd_pci_suspend_prepare(struct device *dev)
 {
 	struct ufs_hba *hba = dev_get_drvdata(dev);
 
-	if (!strcmp(hba->vops->name, "intel-pci"))
+	if (hba->vops && !strcmp(hba->vops->name, "intel-pci"))
 		return ufs_intel_suspend_prepare(dev);
 
 	return ufshcd_suspend_prepare(dev);
@@ -654,7 +654,7 @@ static void ufshcd_pci_resume_complete(struct device *dev)
 {
 	struct ufs_hba *hba = dev_get_drvdata(dev);
 
-	if (!strcmp(hba->vops->name, "intel-pci")) {
+	if (hba->vops && !strcmp(hba->vops->name, "intel-pci")) {
 		ufs_intel_resume_complete(dev);
 		return;
 	}
-- 
2.56.0.506.g506a7eabc5-goog

Re: [PATCH] scsi: ufs: ufs-pci: Check hba->vops in system PM callbacks

[Adrian Hunter]

On 11/11/2026 10:48, Stanley Jhu wrote:
> ufshcd_pci_tbl[] defines the Samsung 0xC00C and AMD 0x1B29 PCI IDs
> with .driver_data set to 0, so ufshcd_pci_probe() leaves hba->vops
> NULL. Both ufshcd_pci_suspend_prepare() and
> ufshcd_pci_resume_complete() dereference hba->vops->name without
> checking hba->vops:
> 
> 1. System suspend on an AMD 0x1B29 or Samsung 0xC00C host enters the
>     PM prepare phase and calls ufshcd_pci_suspend_prepare().
> 2. ufshcd_pci_suspend_prepare() evaluates
>     strcmp(hba->vops->name, "intel-pci"), dereferences NULL, and
>     triggers a kernel oops in the suspending task.
> 
> Check that hba->vops is non-NULL before reading hba->vops->name in
> both callbacks so hosts without variant operations use the generic
> ufshcd_suspend_prepare() and ufshcd_resume_complete() paths.
> 
> Fixes: bb44826c3bdb ("scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers")
> Cc: stable@vger.kernel.org
> Signed-off-by: Stanley Jhu <stanleyjhu@google.com>

Reviewed-by: Adrian Hunter <adrian.hunter@intel.com>

> ---
>   drivers/ufs/host/ufshcd-pci.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/ufs/host/ufshcd-pci.c b/drivers/ufs/host/ufshcd-pci.c
> index 668b57403e62..f9abbbc436f4 100644
> --- a/drivers/ufs/host/ufshcd-pci.c
> +++ b/drivers/ufs/host/ufshcd-pci.c
> @@ -644,7 +644,7 @@ static int ufshcd_pci_suspend_prepare(struct device *dev)
>   {
>   	struct ufs_hba *hba = dev_get_drvdata(dev);
>   
> -	if (!strcmp(hba->vops->name, "intel-pci"))
> +	if (hba->vops && !strcmp(hba->vops->name, "intel-pci"))
>   		return ufs_intel_suspend_prepare(dev);
>   
>   	return ufshcd_suspend_prepare(dev);
> @@ -654,7 +654,7 @@ static void ufshcd_pci_resume_complete(struct device *dev)
>   {
>   	struct ufs_hba *hba = dev_get_drvdata(dev);
>   
> -	if (!strcmp(hba->vops->name, "intel-pci")) {
> +	if (hba->vops && !strcmp(hba->vops->name, "intel-pci")) {
>   		ufs_intel_resume_complete(dev);
>   		return;
>   	}