Received: by 2002:a05:7412:8598:b0:f9:33c2:5753 with SMTP id n24csp123175rdh; Mon, 18 Dec 2023 13:41:52 -0800 (PST) X-Google-Smtp-Source: AGHT+IElsewwzOZDmwECxfAYv3ikq7ZMQhfj8PLxm8tF8P5RMDnbbBBqMTTjDKYUYQGKFHdvokmc X-Received: by 2002:a05:6808:14d5:b0:3b9:dbc5:2fda with SMTP id f21-20020a05680814d500b003b9dbc52fdamr22215483oiw.49.1702935712313; Mon, 18 Dec 2023 13:41:52 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1702935712; cv=none; d=google.com; s=arc-20160816; b=m024dSRTJ20uTZDvTLM9xDXx+LRPUcIK0Tow+wmEyM+4giTHcMHiJf4mBF2VljV4NH lEyESONd5VN2zoUT8czqO7l4Unm4KfekbYPRmKED0BMA6iUA4yOeqTVlVa09ukghfXQN 4KSQ1rOZBjXICnfBvB8yTnU6Sepc6nd3xgFk96QK1qFw2tjgC9pD5rpeSeS3gG0kAr8b 1lyN/z+kSWsFuqQybTJGycVzkS0Ns98ye/ZJ1ad0IYqxlATqKKl/EeTrAx2SBAAWNPlB l4a0xV6XzM+4oLBkCd5wV0g3vf+jrNwkmR0Hz4fmEu7PBnqdMncI6zJGhBJvHXyPeBOe n1Dw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:in-reply-to:from:references:cc:to :content-language:subject:user-agent:mime-version:list-unsubscribe :list-subscribe:list-id:precedence:date:message-id; bh=0Lf6x/s/QNuvXO3/maFmMWf//6tmMOSX9Okk2scVa1c=; fh=xA2k6OFyu4j3Vt1qKzT+PLiE/EvFw8JQeCJGhNAb4LU=; b=u6VIUwDP8TlLnoapbdfHIMo5ezF1Cn349W2vG4eBZmQIjlr+VI1q0xQ08/404dXdoV by+BHvKfunrk2pGt8dKgDwE6ssTjE3GzJ1kFHFkam2umpAMIfWojAhPBP2LHXvQzbzyJ 3d9RjpfzbrHX3es4BX7T7gxM+y7Cg7K76V4XwFmGNgZZbeKK79G858BBFMY8UHllwDo3 viph6I+QmquBqdaE1KOARP0o6MEJrk87swMG1jYUv+iuYuX0r2YP0fiPKB+VDnsUZTOM vYi+zFDBzYBc6jvhcGBrCkJLnHlNQy9JW89YHtAN545ITeelXmYqu/Un2zv9BAwyx6OA LHZg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel+bounces-4412-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) smtp.mailfrom="linux-kernel+bounces-4412-linux.lists.archive=gmail.com@vger.kernel.org"; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=acm.org Return-Path: Received: from ny.mirrors.kernel.org (ny.mirrors.kernel.org. [2604:1380:45d1:ec00::1]) by mx.google.com with ESMTPS id t22-20020a0cb396000000b0067a56b2ec60si7267417qve.168.2023.12.18.13.41.52 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 18 Dec 2023 13:41:52 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel+bounces-4412-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel+bounces-4412-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) smtp.mailfrom="linux-kernel+bounces-4412-linux.lists.archive=gmail.com@vger.kernel.org"; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=acm.org Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ny.mirrors.kernel.org (Postfix) with ESMTPS id 134901C21CE5 for ; Mon, 18 Dec 2023 21:41:52 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id B8064740B8; Mon, 18 Dec 2023 21:41:42 +0000 (UTC) X-Original-To: linux-kernel@vger.kernel.org Received: from mail-oo1-f51.google.com (mail-oo1-f51.google.com [209.85.161.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0A8C51DA3A; Mon, 18 Dec 2023 21:41:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=acm.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Received: by mail-oo1-f51.google.com with SMTP id 006d021491bc7-58e256505f7so2537406eaf.3; Mon, 18 Dec 2023 13:41:40 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1702935700; x=1703540500; h=content-transfer-encoding:in-reply-to:from:references:cc:to :content-language:subject:user-agent:mime-version:date:message-id :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=0Lf6x/s/QNuvXO3/maFmMWf//6tmMOSX9Okk2scVa1c=; b=LcewoDHFMKU2Y0ff8fEFmnakzg9oFuextUFVB/e4hwggKflD6cQLzU40kcgzLPpDzP Mo+I7S6JUBCaE2sB6CGxRo0WIf3bkrMZKBciC3IclRbiQLry1rVXMlvMK5BLXs7rM9ca l2/S59ZnfDkM9vWUz5TmDcWDSpuYN9toqEHq7oe1yIsXp5ehk4Ysr8ch6yTMibRP+SQR vQhx5nS/6AtfiXQyt/7jtwkzh5E8TOgncZGo6zERFv9jgpoYNGtYhA9Zkfwaszl5j/w6 OeXWH8qv5Jtx2s7qDKeMzt98LDOLu24VyIGswoxau+TV+vNvIK+n5zP8agskr7t67pvp L3Tg== X-Gm-Message-State: AOJu0YyMY1BUOwA1a3uPi3FpouOjjGsV8vjbUydmA2KvDwtpOHbQPO41 5pCyvdcDVwKQpHvt1J/AyBI= X-Received: by 2002:a05:6358:e4a1:b0:172:d67c:61f1 with SMTP id by33-20020a056358e4a100b00172d67c61f1mr1664629rwb.14.1702935699775; Mon, 18 Dec 2023 13:41:39 -0800 (PST) Received: from ?IPV6:2620:0:1000:8411:e67:7ba6:36a9:8cd5? ([2620:0:1000:8411:e67:7ba6:36a9:8cd5]) by smtp.gmail.com with ESMTPSA id a21-20020a62e215000000b006d63ace8508sm3075061pfi.70.2023.12.18.13.41.36 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 18 Dec 2023 13:41:39 -0800 (PST) Message-ID: <7cdfa93b-70f7-4912-bda7-a6b50b93c665@acm.org> Date: Mon, 18 Dec 2023 13:41:35 -0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] scsi: ufs: core: Let the sq_lock protect sq_tail_slot access Content-Language: en-US To: Can Guo , mani@kernel.org, adrian.hunter@intel.com, beanhuo@micron.com, avri.altman@wdc.com, junwoo80.lee@samsung.com, martin.petersen@oracle.com Cc: linux-scsi@vger.kernel.org, linux-arm-msm@vger.kernel.org, Alim Akhtar , "James E.J. Bottomley" , Stanley Chu , Asutosh Das , Peter Wang , "Bao D. Nguyen" , Arthur Simchaev , open list References: <1702913550-20631-1-git-send-email-quic_cang@quicinc.com> From: Bart Van Assche In-Reply-To: <1702913550-20631-1-git-send-email-quic_cang@quicinc.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 12/18/23 07:32, Can Guo wrote: > If access sq_tail_slot without the protection from the sq_lock, race > condition can have multiple SQEs copied to duplicate SQE slot(s), which can > lead to multiple incredible stability issues. Fix it by moving the *dest > initialization, in ufshcd_send_command(), back under protection from the > sq_lock. > > Fixes: 3c85f087faec ("scsi: ufs: mcq: Use pointer arithmetic in ufshcd_send_command()") > Signed-off-by: Can Guo > > diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c > index ae9936f..2994aac 100644 > --- a/drivers/ufs/core/ufshcd.c > +++ b/drivers/ufs/core/ufshcd.c > @@ -2274,9 +2274,10 @@ void ufshcd_send_command(struct ufs_hba *hba, unsigned int task_tag, > if (is_mcq_enabled(hba)) { > int utrd_size = sizeof(struct utp_transfer_req_desc); > struct utp_transfer_req_desc *src = lrbp->utr_descriptor_ptr; > - struct utp_transfer_req_desc *dest = hwq->sqe_base_addr + hwq->sq_tail_slot; > + struct utp_transfer_req_desc *dest; > > spin_lock(&hwq->sq_lock); > + dest = hwq->sqe_base_addr + hwq->sq_tail_slot; > memcpy(dest, src, utrd_size); > ufshcd_inc_sq_tail(hwq); > spin_unlock(&hwq->sq_lock); Reviewed-by: Bart Van Assche