From nobody Thu Aug 27 05:12:45 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hVqQq4l5Kz6qRcS for ; Thu, 27 Aug 2026 05:12:51 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hVqQq1FWQz3h90 for ; Thu, 27 Aug 2026 05:12:51 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787807571; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=LTlC7542d7AcJVxN5E98qy5voT+uzuQxpwASJt/jCZs=; b=sVKR8XbFJcLEemumKgDESlMhZIPchI60a1H+wq+BuPuYPAfBc4oT+BKXCBYbjdVyyuMZ+L 6Ok8pAQaGkvm0uB8+4X1HFNKQyiX7bu2NZfNFs8iEHoMUmfyp6AUDvDSRfNnNLGTMCdKx+ cDIlyxoqnFauEf+/M+I1Qhsx9ADhUyoV3kf8lUNHQqTL9mwKg8vb51wUQ0ykLia/N5yu0a OR/6/2KKcchitZi5LoHTtQ5QGSP+EDa1hqKPVDklGyNXH7iWx9s5pNwGMoq5oeXDCW0MS/ fRpdTDjkMAwiHNnRm89KtVeCXYofXc+j224ePRlqp77nML2jhxSHdbP43vbOXw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1787807571; a=rsa-sha256; cv=none; b=EqjU1ST5He3y7Ylf//WBKvpaaM68ZRbuT+uSKEdafhLJWmH8VYLf7Dob/tCJDMblX6OyNa YFKzwY4FXdU/MwpYsr1Ai75wWDmRcDqOJfKsoY6BQxrElqPyIWhu2lHsBeIofb1EUsjwey SeNrbOylqsYUxZEVVygzMYYu4IlFpWXml0mLYptAZ5QTtZOqqVkBfJp0dOCYNcbLYcl+z1 8BOdHBRg5lO4tPrHhyesnyfglX+JO//8fKX0PDINxUBfNPI3h4N8za7syo+tEyktHPAlaB yijCJ08WutsKK6CEoKvJU7ZBXtf+KK95jx0ZaI9ndolCWsT1LbMqK8zgqjym3Q== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787807571; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=LTlC7542d7AcJVxN5E98qy5voT+uzuQxpwASJt/jCZs=; b=QXuGqusqxdTGWuswq2UxOdXa3U9LVrX9wQdNH3jgJWKaGxQZP3DIigPO38F4RlBzmdz+K2 sUYl3ijVsMKnGnPB5QaC+64YXtkUK1Mt8VtpEiIbQZB4EPJ+37tME98S1L1bvukYa2ZPQ0 Sfu/uJfeVt9pYH8uN0wFEEdr9GXPzzVUI04oDGLvXTFxtvYEoWYd5dq0iUiDxGDHviQLsq /vxLSI2uRDr4xvOUNZ4WuoWV5zc5QfJ6tA90Kq72SAXpFxHzZKGqs2CvOxUgF9sxJCpi9S p4qJEqU2W/fsehQnmIVGT7y65Pk3fG1ETv863eLxjOt2OfLjPstZO3QA2TQ8bQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hVqQq0BVJz18mx for ; Thu, 27 Aug 2026 05:12:51 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 419c5 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Thu, 27 Aug 2026 05:12:45 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Jaeyoon Choi Subject: git: 1258ae2bcb55 - main - ufshci: run the controller fail path only once List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: jaeyoon X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 1258ae2bcb559854c966e425f4c5c48668d3cf7b Auto-Submitted: auto-generated Date: Thu, 27 Aug 2026 05:12:45 +0000 Message-Id: <6a8fc74d.419c5.70aab2c7@gitrepo.freebsd.org> The branch main has been updated by jaeyoon: URL: https://cgit.FreeBSD.org/src/commit/?id=1258ae2bcb559854c966e425f4c5c48668d3cf7b commit 1258ae2bcb559854c966e425f4c5c48668d3cf7b Author: Jaeyoon Choi AuthorDate: 2026-08-27 04:58:21 +0000 Commit: Jaeyoon Choi CommitDate: 2026-08-27 05:08:37 +0000 ufshci: run the controller fail path only once Two threads could run ufshci_ctrlr_fail() at the same time. Each one walked the queues and completed the same trackers again, which caused a double free and a panic. Turn is_failed into an atomic gate, so only the first caller walks the queues. The reset task now returns early on a failed controller instead of re-enabling it. Reviewed by: imp (mentor) Sponsored by: Samsung Electronics Differential Revision: https://reviews.freebsd.org/D58944 --- sys/dev/ufshci/ufshci_ctrlr.c | 12 +++++++++++- sys/dev/ufshci/ufshci_private.h | 2 +- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/sys/dev/ufshci/ufshci_ctrlr.c b/sys/dev/ufshci/ufshci_ctrlr.c index bb07ad5f76da..2f930d55a295 100644 --- a/sys/dev/ufshci/ufshci_ctrlr.c +++ b/sys/dev/ufshci/ufshci_ctrlr.c @@ -15,7 +15,13 @@ static void ufshci_ctrlr_fail(struct ufshci_controller *ctrlr) { - ctrlr->is_failed = true; + /* + * The attach thread and the reset task can both fail the + * controller. A second queue walk would complete the same + * trackers again. + */ + if (atomic_swap_32(&ctrlr->is_failed, 1) != 0) + return; ufshci_req_queue_fail(ctrlr, &ctrlr->task_mgmt_req_queue); ufshci_req_queue_fail(ctrlr, &ctrlr->transfer_req_queue); @@ -312,6 +318,10 @@ ufshci_ctrlr_reset_task(void *arg, int pending) struct ufshci_controller *ctrlr = arg; int error; + /* A failed controller must not be re-enabled. */ + if (ctrlr->is_failed) + return; + /* Release resources */ ufshci_utmr_req_queue_disable(ctrlr); ufshci_utr_req_queue_disable(ctrlr); diff --git a/sys/dev/ufshci/ufshci_private.h b/sys/dev/ufshci/ufshci_private.h index d87651a46a2a..d65c1b126cd6 100644 --- a/sys/dev/ufshci/ufshci_private.h +++ b/sys/dev/ufshci/ufshci_private.h @@ -409,7 +409,7 @@ struct ufshci_controller { uint32_t max_tx_lanes; uint32_t max_rx_lanes; - bool is_failed; + uint32_t is_failed; }; #define ufshci_mmio_offsetof(reg) offsetof(struct ufshci_registers, reg)