mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: Li Qiang <liqiang01@kylinos.cn>
To: linux-scsi@vger.kernel.org
Cc: bvanassche@acm.org, linux-kernel@vger.kernel.org,
	alim.akhtar@samsung.com, avri.altman@wdc.com,
	James.Bottomley@HansenPartnership.com,
	martin.petersen@oracle.com, peter.wang@mediatek.com,
	beanhuo@micron.com, can.guo@oss.qualcomm.com,
	adrian.hunter@intel.com, tomas.winkler@intel.com
Subject: [PATCH v2 2/6] scsi: ufs: Avoid NULL CQE dereference when reporting invalid tags
Date: Fri, 17 Jul 2026 23:39:09 +0800	[thread overview]
Message-ID: <20260717153914.26321-3-liqiang01@kylinos.cn> (raw)
In-Reply-To: <20260717153914.26321-1-liqiang01@kylinos.cn>

The single-doorbell completion path can call ufshcd_compl_one_cqe() with

a NULL CQE. If no command is associated with the completion tag, the

warning message dereferences the CQE while reporting the error.

Avoid that dereference and include the invalid tag in the warning.

Fixes: 22089c218037 ("scsi: ufs: core: Optimize the hot path")
Signed-off-by: Li Qiang <liqiang01@kylinos.cn>
---
 drivers/ufs/core/ufshcd.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
index 3541da5b6f4d..d1b989abc9e2 100644
--- a/drivers/ufs/core/ufshcd.c
+++ b/drivers/ufs/core/ufshcd.c
@@ -5860,8 +5860,8 @@ void ufshcd_compl_one_cqe(struct ufs_hba *hba, int task_tag,
 	struct ufshcd_lrb *lrbp = scsi_cmd_priv(cmd);
 	enum utp_ocs ocs;
 
-	if (WARN_ONCE(!cmd, "cqe->command_desc_base_addr = %#llx\n",
-		      le64_to_cpu(cqe->command_desc_base_addr)))
+	if (WARN_ONCE(!cmd, "invalid completion tag %d, cqe->command_desc_base_addr = %#llx\n",
+		      task_tag, cqe ? le64_to_cpu(cqe->command_desc_base_addr) : 0ULL))
 		return;
 
 	if (hba->monitor.enabled) {
-- 
2.43.0


  parent reply	other threads:[~2026-07-17 15:39 UTC|newest]

Thread overview: 20+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-07-16  6:19 [PATCH 0/5] scsi: ufs: Fix descriptor parsing and invalid input handling liqiang
2026-07-16  6:19 ` [PATCH 1/5] scsi: ufs: core: Validate string descriptors liqiang
2026-07-16 17:47   ` Bart Van Assche
2026-07-17 15:35     ` Li Qiang
2026-07-16  6:19 ` [PATCH 2/5] scsi: ufs: Fix NULL dereferences after tag lookup liqiang
2026-07-16 17:52   ` Bart Van Assche
2026-07-16  6:19 ` [PATCH 3/5] scsi: ufs: core: Validate connected lane counts liqiang
2026-07-16  6:19 ` [PATCH 4/5] scsi: ufs: rpmb: Validate frame before parsing liqiang
2026-07-16 17:58   ` Bart Van Assche
2026-07-16  6:19 ` [PATCH 5/5] scsi: ufs: debugfs: Reserve space for a string terminator liqiang
2026-07-16 17:56   ` Bart Van Assche
2026-07-16 17:42 ` [PATCH 0/5] scsi: ufs: Fix descriptor parsing and invalid input handling Bart Van Assche
2026-07-17 15:16   ` Li Qiang
2026-07-17 15:39 ` [PATCH v2 0/6] " Li Qiang
2026-07-17 15:39   ` [PATCH v2 1/6] scsi: ufs: core: Validate string descriptors Li Qiang
2026-07-17 15:39   ` Li Qiang [this message]
2026-07-17 15:39   ` [PATCH v2 3/6] scsi: ufs: core: Validate connected lane counts Li Qiang
2026-07-17 15:39   ` [PATCH v2 4/6] scsi: ufs: rpmb: Validate request frame length before parsing Li Qiang
2026-07-17 15:39   ` [PATCH v2 5/6] scsi: ufs: rpmb: Use unaligned accessors for RPMB frames Li Qiang
2026-07-17 15:39   ` [PATCH v2 6/6] scsi: ufs: debugfs: Reserve space for a string terminator Li Qiang

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260717153914.26321-3-liqiang01@kylinos.cn \
    --to=liqiang01@kylinos.cn \
    --cc=James.Bottomley@HansenPartnership.com \
    --cc=adrian.hunter@intel.com \
    --cc=alim.akhtar@samsung.com \
    --cc=avri.altman@wdc.com \
    --cc=beanhuo@micron.com \
    --cc=bvanassche@acm.org \
    --cc=can.guo@oss.qualcomm.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-scsi@vger.kernel.org \
    --cc=martin.petersen@oracle.com \
    --cc=peter.wang@mediatek.com \
    --cc=tomas.winkler@intel.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox