Re: [PATCH v2 1/2] scsi: ufs: Fix a possible NULL pointer issue

From: Can Guo
Date: Sat Jan 16 2021 - 12:28:26 EST

On 2021-01-15 21:07, Adrian Hunter wrote:
On 2/01/21 3:10 pm, Can Guo wrote:
On 2021-01-02 20:29, Can Guo wrote:
On 2021-01-02 00:05, Bart Van Assche wrote:
On 12/31/20 9:44 PM, Can Guo wrote:
During system resume/suspend, hba could be NULL. In this case, do not touch

Fixes: 88a92d6ae4fe ("scsi: ufs: Serialize eh_work with system PM events
and async scan")

Signed-off-by: Can Guo <cang@xxxxxxxxxxxxxx>
 drivers/scsi/ufs/ufshcd.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index e221add..34e2541 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -8896,8 +8896,11 @@ int ufshcd_system_suspend(struct ufs_hba *hba)
     int ret = 0;
     ktime_t start = ktime_get();

+    if (!hba)
+        return 0;
-    if (!hba || !hba->is_powered)
+    if (!hba->is_powered)
         return 0;

     if ((ufs_get_pm_lvl_to_dev_pwr_mode(hba->spm_lvl) ==
@@ -8945,10 +8948,8 @@ int ufshcd_system_resume(struct ufs_hba *hba)
     int ret = 0;
     ktime_t start = ktime_get();

-    if (!hba) {
-        up(&hba->eh_sem);
+    if (!hba)
         return -EINVAL;
-    }

     if (!hba->is_powered || pm_runtime_suspended(hba->dev))

Hi Can,

How can ufshcd_system_suspend() or ufshcd_system_resume() be called with a
NULL argument? In ufshcd_pci_probe() I see that pci_set_drvdata() is called
before pm_runtime_allow(). ufshcd_pci_remove() calls pm_runtime_forbid().



Hi Bart,

You are right about ufshcd_RUNTIME_suspend/resume() - platform_set_drvdata()
is called before pm_runtime_enable(), so runtime suspend/resume cannot happen
before pm_runtime_enable() is called. We can remove the sanity checks of
!hba there, they are outdated.

Add more history here - before Stanley's change (see below),
is called AFTER pm_runtime_enable(), which was why we needed sanity checks
of !hba.
But now the sanity checks are unnecessary in
ufshcd_RUNTIME_suspend/resume(), so
feel free to remove them.

But still, things are a bit different for ufshcd_SYSTEM_suspend/resume(), we
the sanity checks of !hba there if my understanding is correct.

commit 24e2e7a19f7e4b83d0d5189040d997bce3596473
Author: Stanley Chu <stanley.chu@xxxxxxxxxxxx>
Date:   Wed Jun 12 23:19:05 2019 +0800

    scsi: ufs: Avoid runtime suspend possibly being blocked forever

Can Guo.

But for ufshcd_SYSTEM_suspend/resume() callbacks (not runtime ones), my
understanding is that system suspend/resume may happen after probe (vendor
driver probe calls ufshcd_pltfrm_init()) starts but before
is called, in this case hba is NULL.

int ufshcd_pltfrm_init(struct platform_device *pdev,
               const struct ufs_hba_variant_ops *vops)
     platform_set_drvdata(pdev, hba);


Hi Can

I expect probe and system suspend are synchronized e.g. by device_lock(), so
hba would not be NULL. Is there any example of it being NULL in system suspend?


Hi Adrian,

Thanks for the remind - I didn't notice they are protected by device_lock().
You are right, hba cannot be NULL in current code... Maybe if (!hba) was
there just for a sanity check. I will make a change to remove these checks.

Can Guo.