From nobody Mon Jan 5 02:38:51 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4dkz582DJpz6NFMG for ; Mon, 05 Jan 2026 02:38:52 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4dkz581GTJz3D1F for ; Mon, 05 Jan 2026 02:38:52 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1767580732; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=qclN7x0jmyQNVqxnHBIqwHoPOoVJ1bAGffuaK5HG3kk=; b=B99cZhdH6XSp7WRBGPBTCFsf/ReH1APXfRoywEtBzKRT9cix475Ej8eTxiuBrpWhMVRlOX 8QsKuNkHEDWr5VpsHjORmIEvEBZNo9m9B99C/AeFtwHQjfF2120zVzVZ7qELvb/OZy6OTS Huf1eZtHwEtfeAPNgDL3sf2H13JTOaAysUU8zNCyvGt4jdZ7sI5uwNFXhQt3kf4iLctXtA AzcqwlkzIFmF3hft+aQzBhLqRQo4knsHVjG0KPLn+0dt6B30gpaHqzmBY3amtcyWnGbEPK RDeO+t+6ZaMhfbGyrEE/6v0lPQ1QnJLRzWE7EAQfcmOrbApVIfah57PYOpz8KA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1767580732; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=qclN7x0jmyQNVqxnHBIqwHoPOoVJ1bAGffuaK5HG3kk=; b=A3o4m32xbM/3GREA4Ppn9HdfE5MLyrZHLqN4sUejfB3CqbNyEbrHhIir7kv0RpHXqRdv2B m81npDhoxf3g0EX/SSQ7Ch6c6MwXD4D2F2U7RPoyFEi52W6HlcYePCRv1OptHBIASZvmjD FPPqRpsJuXM/568aW+OCPLDYTLbJvy2G0rn9kEebCIXtN1iblp8KFl6UESnqGG3jnLhzT0 DyGekyJldIi9M7ddCU123gCrJT0Ylm4rUA9cfmy/wP2bL3kOW7UwuKIWyM/OxUggtH4a0k bNG1w5XHO2Q3LSIv0U6qkhNCdwmDyqh0DfaeVN3fl4AJwBrHVTZ6QvHb8CK98g== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1767580732; a=rsa-sha256; cv=none; b=RrP9EHmKGBb7gMRHJSGBT+5XGLCg1s3HEXE4PIibA1GcHK4RVXDjBcpdkwUY4dsMUfDjli 49xWa8hqpbnxVeAkIquq5DBQltVP+IeWaobc6bhZ8o6GkmhAcjqIwPZh4S1qtm11RSXJQF khLtzy+w7prLSwgHkP7UkRvJLP6dCD4JE7zt7QqeBu9IFHAgUmWLZLng6/h/yWBomAGuRK A/j3gXKAMsy/QHf7wnYvwADZns1mW/118RvWJXL+NQdbCwpL67MkyAc1SgChcVsVn9vuFG 4r9iiM1zTKfQ35b0WKHJSWpFGY7aTwqIoT5ZFx49mv7uYKETNW89HIk27dGdxw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4dkz576ykHz11x7 for ; Mon, 05 Jan 2026 02:38:51 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3eaec by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 05 Jan 2026 02:38:51 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Jaeyoon Choi Subject: git: ef2d7cc11d04 - main - ufshci: Fix task management queue num_trackers on failure path List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: jaeyoon X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: ef2d7cc11d04728f2b97d2b0188d77be77d5c252 Auto-Submitted: auto-generated Date: Mon, 05 Jan 2026 02:38:51 +0000 Message-Id: <695b243b.3eaec.427c136c@gitrepo.freebsd.org> The branch main has been updated by jaeyoon: URL: https://cgit.FreeBSD.org/src/commit/?id=ef2d7cc11d04728f2b97d2b0188d77be77d5c252 commit ef2d7cc11d04728f2b97d2b0188d77be77d5c252 Author: Jaeyoon Choi AuthorDate: 2026-01-05 02:35:52 +0000 Commit: Jaeyoon Choi CommitDate: 2026-01-05 02:35:52 +0000 ufshci: Fix task management queue num_trackers on failure path Fix a kernel panic caused by the task management queue using the transfer request queue’s num_entries value. Sponsored by: Samsung Electronic Reviewed by: imp Differential Revision: https://reviews.freebsd.org/D54243 --- sys/dev/ufshci/ufshci_ctrlr.c | 8 ++------ sys/dev/ufshci/ufshci_private.h | 2 +- sys/dev/ufshci/ufshci_req_queue.c | 14 +++++--------- 3 files changed, 8 insertions(+), 16 deletions(-) diff --git a/sys/dev/ufshci/ufshci_ctrlr.c b/sys/dev/ufshci/ufshci_ctrlr.c index ce0da4cab907..0d7994a033c5 100644 --- a/sys/dev/ufshci/ufshci_ctrlr.c +++ b/sys/dev/ufshci/ufshci_ctrlr.c @@ -17,12 +17,8 @@ ufshci_ctrlr_fail(struct ufshci_controller *ctrlr) { ctrlr->is_failed = true; - ufshci_req_queue_fail(ctrlr, - ctrlr->task_mgmt_req_queue.qops.get_hw_queue( - &ctrlr->task_mgmt_req_queue)); - ufshci_req_queue_fail(ctrlr, - ctrlr->transfer_req_queue.qops.get_hw_queue( - &ctrlr->transfer_req_queue)); + ufshci_req_queue_fail(ctrlr, &ctrlr->task_mgmt_req_queue); + ufshci_req_queue_fail(ctrlr, &ctrlr->transfer_req_queue); } static void diff --git a/sys/dev/ufshci/ufshci_private.h b/sys/dev/ufshci/ufshci_private.h index bcb2bcef0230..0665f29d3896 100644 --- a/sys/dev/ufshci/ufshci_private.h +++ b/sys/dev/ufshci/ufshci_private.h @@ -499,7 +499,7 @@ int ufshci_utmr_req_queue_enable(struct ufshci_controller *ctrlr); void ufshci_utr_req_queue_disable(struct ufshci_controller *ctrlr); int ufshci_utr_req_queue_enable(struct ufshci_controller *ctrlr); void ufshci_req_queue_fail(struct ufshci_controller *ctrlr, - struct ufshci_hw_queue *hwq); + struct ufshci_req_queue *req_queue); int ufshci_req_queue_submit_request(struct ufshci_req_queue *req_queue, struct ufshci_request *req, bool is_admin); void ufshci_req_queue_complete_tracker(struct ufshci_tracker *tr); diff --git a/sys/dev/ufshci/ufshci_req_queue.c b/sys/dev/ufshci/ufshci_req_queue.c index df7e4b159278..33008c6b1230 100644 --- a/sys/dev/ufshci/ufshci_req_queue.c +++ b/sys/dev/ufshci/ufshci_req_queue.c @@ -199,11 +199,10 @@ ufshci_req_queue_manual_complete_request(struct ufshci_req_queue *req_queue, void ufshci_req_queue_fail(struct ufshci_controller *ctrlr, - struct ufshci_hw_queue *hwq) + struct ufshci_req_queue *req_queue) { - struct ufshci_req_queue *req_queue; + struct ufshci_hw_queue *hwq = req_queue->qops.get_hw_queue(req_queue); struct ufshci_tracker *tr; - struct ufshci_request *req; int i; if (!mtx_initialized(&hwq->qlock)) @@ -211,16 +210,13 @@ ufshci_req_queue_fail(struct ufshci_controller *ctrlr, mtx_lock(&hwq->qlock); - req_queue = &ctrlr->transfer_req_queue; - - for (i = 0; i < req_queue->num_entries; i++) { + for (i = 0; i < req_queue->num_trackers; i++) { tr = hwq->act_tr[i]; - req = tr->req; if (tr->slot_state == UFSHCI_SLOT_STATE_RESERVED) { mtx_unlock(&hwq->qlock); - ufshci_req_queue_manual_complete_request(req_queue, req, - UFSHCI_DESC_ABORTED, + ufshci_req_queue_manual_complete_request(req_queue, + tr->req, UFSHCI_DESC_ABORTED, UFSHCI_RESPONSE_CODE_GENERAL_FAILURE); mtx_lock(&hwq->qlock); } else if (tr->slot_state == UFSHCI_SLOT_STATE_SCHEDULED) {