A race can occur between the MCQ completion path and the abort handler:
once a request completes, __blk_mq_free_request() sets rq->mq_hctx to
NULL, meaning the subsequent ufshcd_mcq_req_to_hwq() call in
ufshcd_mcq_abort() can return a NULL pointer. If this NULL pointer is
dereferenced, the kernel will crash.

Add a NULL check for the returned hwq pointer. If hwq is NULL, log an
error and return FAILED, preventing a potential NULL-pointer dereference.

This is similar to the fix in commit 74736103fb41
("scsi: ufs: core: Fix ufshcd_abort_one racing issue").

This is found by our static analysis tool KNighter.

Signed-off-by: Chenyuan Yang <chenyuan0y@gmail.com>
Fixes: f1304d442077 ("scsi: ufs: mcq: Added ufshcd_mcq_abort()")
---
 drivers/ufs/core/ufs-mcq.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/ufs/core/ufs-mcq.c b/drivers/ufs/core/ufs-mcq.c
index 240ce135bbfb..2c8792911616 100644
--- a/drivers/ufs/core/ufs-mcq.c
+++ b/drivers/ufs/core/ufs-mcq.c
@@ -692,6 +692,11 @@ int ufshcd_mcq_abort(struct scsi_cmnd *cmd)
 	}
 
 	hwq = ufshcd_mcq_req_to_hwq(hba, scsi_cmd_to_rq(cmd));
+	if (!hwq) {
+		dev_err(hba->dev, "%s: failed to get hwq for tag %d\n",
+			__func__, tag);
+		return FAILED;
+	}
 
 	if (ufshcd_mcq_sqe_search(hba, hwq, tag)) {
 		/*
-- 
2.34.1

On 4/9/25 1:45 PM, Chenyuan Yang wrote:
> A race can occur between the MCQ completion path and the abort handler:
> once a request completes, __blk_mq_free_request() sets rq->mq_hctx to
> NULL, meaning the subsequent ufshcd_mcq_req_to_hwq() call in
> ufshcd_mcq_abort() can return a NULL pointer. If this NULL pointer is
> dereferenced, the kernel will crash.
> 
> Add a NULL check for the returned hwq pointer. If hwq is NULL, log an
> error and return FAILED, preventing a potential NULL-pointer dereference.
> 
> This is similar to the fix in commit 74736103fb41
> ("scsi: ufs: core: Fix ufshcd_abort_one racing issue").
> 
> This is found by our static analysis tool KNighter.
> 
> Signed-off-by: Chenyuan Yang <chenyuan0y@gmail.com>
> Fixes: f1304d442077 ("scsi: ufs: mcq: Added ufshcd_mcq_abort()")
> ---
>   drivers/ufs/core/ufs-mcq.c | 5 +++++
>   1 file changed, 5 insertions(+)
> 
> diff --git a/drivers/ufs/core/ufs-mcq.c b/drivers/ufs/core/ufs-mcq.c
> index 240ce135bbfb..2c8792911616 100644
> --- a/drivers/ufs/core/ufs-mcq.c
> +++ b/drivers/ufs/core/ufs-mcq.c
> @@ -692,6 +692,11 @@ int ufshcd_mcq_abort(struct scsi_cmnd *cmd)
>   	}
>   
>   	hwq = ufshcd_mcq_req_to_hwq(hba, scsi_cmd_to_rq(cmd));
> +	if (!hwq) {
> +		dev_err(hba->dev, "%s: failed to get hwq for tag %d\n",
> +			__func__, tag);
> +		return FAILED;
> +	}
>   
>   	if (ufshcd_mcq_sqe_search(hba, hwq, tag)) {
>   		/*

This patch makes the ufshcd_cmd_inflight() check just above the
modified code superfluous. Please remove it.

Additionally, please change the error message such that it reports
that the command has already completed.

Thanks,

Bart.