From nobody Tue Oct 06 07:51:27 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hzT3N3Bb9z6cWGQ for ; Tue, 06 Oct 2026 07:51:28 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hzT3N062Gz4HDV for ; Tue, 06 Oct 2026 07:51:28 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791273088; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=e5JD5uvLLyw+bLeOVrvNRsIqytqP7tXnylqRAFHPO7A=; b=Aaxc2EZ80ThcMdVODDbYUUxJVsSzabFz9fs6Pk8R0x4mESGosTCT5WtoOF5zgL/vqOdq1a Hkcgk+Rw+iL2OowHL/taUQhxwIY05pdSBNQ/4xkZEn/UhpxwJmsp8ODBt5A9BLOGIU/y0N LMEb03aIgnzukkte5QKoVEWlXzvgfdQY2nYz+pVFvBumq7YJLRQbtD02t5sXU6nX+tIpj9 3U3v/wknyHiXmgtIylvzLyZr4ZICIM+gnL1S7TTGnEMquLZd/qoEIgYWRkg6AxFP07Ecm1 S++Mm6YwVLjQXTS11l5Qf5pTBBnup9+dH3Hd9LE4yy88IdTHFBTwQpVLq4dnIA== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1791273088; b=xJ6gwvP0T84bj+HUNtWcg7eU1DbNfhKhtPuNNOYYDGKvS1Czs1bEPOQRa5aYUga/mfWk01 azMgKdhY1iuKuh19DqH32WJ4lTMZg57HxNRyLHPyJBwDlgoVbQIj3jeXevgruEe6xBygMZ /BKTlewHUzPAX+tGxhTNnEo9f58Fv7XomxUWMy4df+Hk0Tl7DxfN8ysddCxljpb0jsRK2u SnRGg7ygoaBViHJI6emWn7dV93nCzd90oaveyv3JdR2tM+VazResj6djIKrkNgPK42Nfwi qwxQIUQsd9Uxn6XsGwHfqGisPk9z4xxA43zhmMfw8Ni+xJhPTRVm12wYaIBp0A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791273088; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=e5JD5uvLLyw+bLeOVrvNRsIqytqP7tXnylqRAFHPO7A=; b=hzb3iTsvdJ7F23MClVOfxC7hu75FzPDNWsdlp5lldQDZboNsCgPhvB+4k8k2zSHjdXw4rm 3hjc8FvTeOqfikqGEWRARiWNKQzG5KA2ei+xvCtelFFOn9fjJO1tAwkCvRbvvhTtxm2knV Ev7UlIR+MqnCmnR8B2BQKGmEv6b4ySNoA4Mc6TYpr9HqYp78dvI62gATMV6gpWKiTZ6luU D3HyVMWSV7M9+AsDQ34kVdyRjTYIMjELmL0sbAfjQYmAXKXxcD2PCjRqjVbLmWlcYwjGWZ 9pOnA6Mvjr4vprmZadPRNJ7YhnhK3vIYaQBgr9HSZX+CkLHG8CIrDxeHtybiPw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hzT3M6Hr2zwwj for ; Tue, 06 Oct 2026 07:51:27 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 18aa7 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 06 Oct 2026 07:51:27 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Jaeyoon Choi Subject: git: 94e28f979a84 - stable/15 - ufshci: run the controller fail path only once List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: jaeyoon X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 94e28f979a84251f7108c10db7efc8ccdf424b2e Auto-Submitted: auto-generated Date: Tue, 06 Oct 2026 07:51:27 +0000 Message-Id: <6ac4a87f.18aa7.39ac9949@gitrepo.freebsd.org> The branch stable/15 has been updated by jaeyoon: URL: https://cgit.FreeBSD.org/src/commit/?id=94e28f979a84251f7108c10db7efc8ccdf424b2e commit 94e28f979a84251f7108c10db7efc8ccdf424b2e Author: Jaeyoon Choi AuthorDate: 2026-08-27 04:58:21 +0000 Commit: Jaeyoon Choi CommitDate: 2026-10-06 06:28:04 +0000 ufshci: run the controller fail path only once Two threads could run ufshci_ctrlr_fail() at the same time. Each one walked the queues and completed the same trackers again, which caused a double free and a panic. Turn is_failed into an atomic gate, so only the first caller walks the queues. The reset task now returns early on a failed controller instead of re-enabling it. Reviewed by: imp (mentor) Sponsored by: Samsung Electronics Differential Revision: https://reviews.freebsd.org/D58944 (cherry picked from commit 1258ae2bcb559854c966e425f4c5c48668d3cf7b) --- sys/dev/ufshci/ufshci_ctrlr.c | 12 +++++++++++- sys/dev/ufshci/ufshci_private.h | 2 +- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/sys/dev/ufshci/ufshci_ctrlr.c b/sys/dev/ufshci/ufshci_ctrlr.c index bb07ad5f76da..2f930d55a295 100644 --- a/sys/dev/ufshci/ufshci_ctrlr.c +++ b/sys/dev/ufshci/ufshci_ctrlr.c @@ -15,7 +15,13 @@ static void ufshci_ctrlr_fail(struct ufshci_controller *ctrlr) { - ctrlr->is_failed = true; + /* + * The attach thread and the reset task can both fail the + * controller. A second queue walk would complete the same + * trackers again. + */ + if (atomic_swap_32(&ctrlr->is_failed, 1) != 0) + return; ufshci_req_queue_fail(ctrlr, &ctrlr->task_mgmt_req_queue); ufshci_req_queue_fail(ctrlr, &ctrlr->transfer_req_queue); @@ -312,6 +318,10 @@ ufshci_ctrlr_reset_task(void *arg, int pending) struct ufshci_controller *ctrlr = arg; int error; + /* A failed controller must not be re-enabled. */ + if (ctrlr->is_failed) + return; + /* Release resources */ ufshci_utmr_req_queue_disable(ctrlr); ufshci_utr_req_queue_disable(ctrlr); diff --git a/sys/dev/ufshci/ufshci_private.h b/sys/dev/ufshci/ufshci_private.h index c738e246e96c..7b74faf95c53 100644 --- a/sys/dev/ufshci/ufshci_private.h +++ b/sys/dev/ufshci/ufshci_private.h @@ -423,7 +423,7 @@ struct ufshci_controller { uint32_t max_tx_lanes; uint32_t max_rx_lanes; - bool is_failed; + uint32_t is_failed; }; #define ufshci_mmio_offsetof(reg) offsetof(struct ufshci_registers, reg)