scsi: ufs: core: Fix ufshcd_abort_one racing issue
When ufshcd_abort_one is racing with the completion ISR, the completed tag
of the request's mq_hctx pointer will be set to NULL by ISR. Return
success when request is completed by ISR because ufshcd_abort_one does not
need to do anything.
The racing flow is:
Thread A
ufshcd_err_handler step 1
...
ufshcd_abort_one
ufshcd_try_to_abort_task
ufshcd_cmd_inflight(true) step 3
ufshcd_mcq_req_to_hwq
blk_mq_unique_tag
rq->mq_hctx->queue_num step 5
Thread B
ufs_mtk_mcq_intr(cq complete ISR) step 2
scsi_done
...
__blk_mq_free_request
rq->mq_hctx = NULL; step 4
Below is KE back trace.
ufshcd_try_to_abort_task: cmd at tag 41 not pending in the device.
ufshcd_try_to_abort_task: cmd at tag=41 is cleared.
Aborting tag 41 / CDB 0x28 succeeded
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000194
pc : [0xffffffddd7a79bf8] blk_mq_unique_tag+0x8/0x14
lr : [0xffffffddd6155b84] ufshcd_mcq_req_to_hwq+0x1c/0x40 [ufs_mediatek_mod_ise]
do_mem_abort+0x58/0x118
el1_abort+0x3c/0x5c
el1h_64_sync_handler+0x54/0x90
el1h_64_sync+0x68/0x6c
blk_mq_unique_tag+0x8/0x14
ufshcd_err_handler+0xae4/0xfa8 [ufs_mediatek_mod_ise]
process_one_work+0x208/0x4fc
worker_thread+0x228/0x438
kthread+0x104/0x1d4
ret_from_fork+0x10/0x20
Analysis and contextual insights are available on OpenCVE Cloud.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
| Source | ID | Title |
|---|---|---|
Ubuntu USN |
USN-7089-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7089-2 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7089-3 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7089-4 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7089-5 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7089-6 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7089-7 | Linux kernel (Low Latency) vulnerabilities |
Ubuntu USN |
USN-7090-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7095-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7156-1 | Linux kernel (GKE) vulnerabilities |
Wed, 06 Nov 2024 08:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Wed, 11 Sep 2024 18:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Wed, 11 Sep 2024 13:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Fri, 06 Sep 2024 13:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-362 |
Wed, 21 Aug 2024 19:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Linux
Linux linux Kernel |
|
| Weaknesses | CWE-476 | |
| CPEs | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Linux
Linux linux Kernel |
Status: PUBLISHED
Assigner: Linux
Published:
Updated: 2026-05-11T20:25:17.385Z
Reserved: 2024-07-12T12:17:45.626Z
Link: CVE-2024-41053
Updated: 2024-08-02T04:46:52.306Z
Status : Modified
Published: 2024-07-29T15:15:13.473
Modified: 2024-11-21T09:32:08.850
Link: CVE-2024-41053
OpenCVE Enrichment
No data.
Ubuntu USN