[PATCH] scsi: ufs: core: fix NULL deref in remaining scsi_cmd_priv() callers

[PATCH] scsi: ufs: core: fix NULL deref in remaining scsi_cmd_priv() callers

[shao.mingyin]

From: Shao Mingyin <shao.mingyin@zte.com.cn>

Commit 4cf752f6b99a ("scsi: ufs: core: Fix NULL pointer dereference in
scsi_cmd_priv() calls") fixed the callers that dereference the command
pointer returned by ufshcd_tag_to_cmd() via scsi_cmd_priv() without
checking for NULL first, but three call sites with the same pattern were
left:

- ufshcd_compl_one_cqe(): scsi_cmd_priv(cmd) runs before the !cmd check.
- ufshcd_mcq_sq_cleanup(): scsi_cmd_priv(cmd) and scsi_cmd_to_rq(cmd)
  run before the !cmd check.
- ufshcd_issue_devman_upiu_cmd(): scsi_cmd_priv(cmd) runs before the
  WARN_ON_ONCE(!cmd) check.

Fix these three remaining sites by deferring the pointer arithmetic until
after the NULL check.

Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>

---
diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
index cc75384c6502..76c5400009ff 100644
--- a/drivers/ufs/core/ufshcd.c
+++ b/drivers/ufs/core/ufshcd.c
@@ -5984,13 +5984,15 @@ void ufshcd_compl_one_cqe(struct ufs_hba *hba, int task_tag,
 			  struct cq_entry *cqe)
 {
 	struct scsi_cmnd *cmd = ufshcd_tag_to_cmd(hba, task_tag);
-	struct ufshcd_lrb *lrbp = scsi_cmd_priv(cmd);
+	struct ufshcd_lrb *lrbp;
 	enum utp_ocs ocs;

 	if (WARN_ONCE(!cmd, "invalid completion tag %d, cqe->command_desc_base_addr = %#llx\n",
 		      task_tag, cqe ? le64_to_cpu(cqe->command_desc_base_addr) : 0ULL))
 		return;

+	lrbp = scsi_cmd_priv(cmd);
+
 	if (hba->monitor.enabled) {
 		lrbp->compl_time_stamp = ktime_get();
 		lrbp->compl_time_stamp_local_clock = local_clock();
@@ -7707,7 +7709,7 @@ static int ufshcd_issue_devman_upiu_cmd(struct ufs_hba *hba,
 					enum query_opcode desc_op)
 {
 	struct scsi_cmnd *cmd = ufshcd_get_dev_mgmt_cmd(hba);
-	struct ufshcd_lrb *lrbp = scsi_cmd_priv(cmd);
+	struct ufshcd_lrb *lrbp;
 	u32 tag;
 	int err = 0;
 	u8 upiu_flags;
@@ -7718,6 +7720,8 @@ static int ufshcd_issue_devman_upiu_cmd(struct ufs_hba *hba,
 	if (WARN_ON_ONCE(!cmd))
 		return -ENOMEM;

+	lrbp = scsi_cmd_priv(cmd);
+
 	tag = scsi_cmd_to_rq(cmd)->tag;

 	ufshcd_setup_dev_cmd(hba, cmd, cmd_type, 0, tag);
diff --git a/drivers/ufs/core/ufs-mcq.c b/drivers/ufs/core/ufs-mcq.c
index df293b66350d..ecb54b410730 100644
--- a/drivers/ufs/core/ufs-mcq.c
+++ b/drivers/ufs/core/ufs-mcq.c
@@ -565,8 +565,8 @@ static int ufshcd_mcq_sq_start(struct ufs_hba *hba, struct ufs_hw_queue *hwq)
 int ufshcd_mcq_sq_cleanup(struct ufs_hba *hba, int task_tag)
 {
 	struct scsi_cmnd *cmd = ufshcd_tag_to_cmd(hba, task_tag);
-	struct ufshcd_lrb *lrbp = scsi_cmd_priv(cmd);
-	struct request *rq = scsi_cmd_to_rq(cmd);
+	struct ufshcd_lrb *lrbp;
+	struct request *rq;
 	struct ufs_hw_queue *hwq;
 	void __iomem *reg, *opr_sqd_base;
 	u32 nexus, id, val;
@@ -578,6 +578,9 @@ int ufshcd_mcq_sq_cleanup(struct ufs_hba *hba, int task_tag)
 	if (!cmd)
 		return -EINVAL;

+	lrbp = scsi_cmd_priv(cmd);
+	rq = scsi_cmd_to_rq(cmd);
+
 	hwq = ufshcd_mcq_req_to_hwq(hba, rq);
 	if (!hwq)
 		return 0;

Re: [PATCH] scsi: ufs: core: fix NULL deref in remaining scsi_cmd_priv() callers

[Stanley Jhu]

On Mon, Oct 26, 2026 at 04:47:38PM +0800, shao.mingyin@zte.com.cn wrote:
> - ufshcd_compl_one_cqe(): scsi_cmd_priv(cmd) runs before the !cmd check.
> - ufshcd_mcq_sq_cleanup(): scsi_cmd_priv(cmd) and scsi_cmd_to_rq(cmd)
>    run before the !cmd check.
> - ufshcd_issue_devman_upiu_cmd(): scsi_cmd_priv(cmd) runs before the
>    WARN_ON_ONCE(!cmd) check.

ufshcd_exec_dev_cmd() has the same pattern: scsi_cmd_priv(cmd) runs
before WARN_ON_ONCE(!cmd). Could you cover it in this patch too?

Re: [PATCH] scsi: ufs: core: fix NULL deref in remaining scsi_cmd_priv() callers

[Bart Van Assche]

On 10/26/26 1:47 AM, shao.mingyin@zte.com.cn wrote:
> From: Shao Mingyin <shao.mingyin@zte.com.cn>
> 
> Commit 4cf752f6b99a ("scsi: ufs: core: Fix NULL pointer dereference in
> scsi_cmd_priv() calls") fixed the callers that dereference the command
> pointer returned by ufshcd_tag_to_cmd() via scsi_cmd_priv() without
> checking for NULL first, but three call sites with the same pattern were
> left:
> 
> - ufshcd_compl_one_cqe(): scsi_cmd_priv(cmd) runs before the !cmd check.
> - ufshcd_mcq_sq_cleanup(): scsi_cmd_priv(cmd) and scsi_cmd_to_rq(cmd)
>    run before the !cmd check.
> - ufshcd_issue_devman_upiu_cmd(): scsi_cmd_priv(cmd) runs before the
>    WARN_ON_ONCE(!cmd) check.
> 
> Fix these three remaining sites by deferring the pointer arithmetic until
> after the NULL check.

In the Linux kernel, passing NULL to container_of() is safe if the
result of container_of() is not used. The code modified by this patch
does not use the result of container_of() before checking that the 
pointer passed to container_of() is not NULL. In other words, this patch
doesn't fix any bugs.

Bart.