Re: [PATCH v2 0/4] scsi: ufs: core: Factor hba->outstanding_reqs helper and fix double completion

[Bart Van Assche]

On 10/18/26 12:52 PM, Bean Huo wrote:
> One more place has the same problem. In ufshcd_abort(), the "cmd was completed,
> but without a notifying intr" path completes the request but leaves its bit set
> in hba->outstanding_reqs:
>
> if (!hba->mcq_enabled && !(reg & (1 << tag))) {
> 	...
> 	 __ufshcd_transfer_req_compl(hba, 1UL << tag);
> 	...
> }
>
>
> could use the new helper in the same way as patch 2?
>
>
>   if (ufshcd_clear_outstanding_reqs(hba, BIT(tag)))
> 	ufshcd_compl_one_cqe(hba, tag, NULL);

Hi Bean,

There are two problems with calling ufshcd_compl_one_cqe() from
ufshcd_abort():
* ufshcd_compl_one_cqe() must only be called for SCSI commands while
  'tag' may refer to a device management command.
* SCSI commands must not be freed by a SCSI abort handler. Otherwise
  a use-after-free may be triggered in scmd_eh_abort_handler() when it
  tries to call scsi_queue_insert() or scsi_finish_command().

Bart.