From eb2c4847a1cb2f426cfc702364df7a38ebbf730b Mon Sep 17 00:00:00 2001 From: Stanley Jhu Date: Thu, 22 Oct 2026 11:44:43 +0800 Subject: [PATCH] scsi: ufs: core: Do not release a reserved request in ufshcd_abort() In SDB mode, aborting a timed-out device management request drops a clock hold that the request never took: 1. ufshcd_dev_man_lock() takes one ufshcd_hold() for the whole device management command. ufshcd_queue_reserved_command() submits the request without taking a hold of its own. 2. The request times out and ufshcd_abort() clears its slot with ufshcd_clear_cmd(). 3. ufshcd_abort() claims BIT(tag) in hba->outstanding_reqs and calls ufshcd_release_scsi_cmd(), which calls ufshcd_release() for a hold the request never took. 4. When ufshcd_dev_man_unlock() drops the hold from step 1, hba->clk_gating.active_reqs goes below zero. Release the command only if it is a SCSI command. Fixes: 08b12cda6c44 ("scsi: ufs: core: Switch to scsi_get_internal_cmd()") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/2060a8da-581b-46d1-a510-779f4df716cd@acm.org Reviewed-by: Bart Van Assche Reviewed-by: Peter Wang Signed-off-by: Stanley Jhu Reviewed-by: Bean Huo Link: https://patch.msgid.link/20261022034443.3034432-7-stanleyjhu@google.com Signed-off-by: Martin K. Petersen (Oracle) --- drivers/ufs/core/ufshcd.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c index 834c7f3b592e..ddb232ef07a8 100644 --- a/drivers/ufs/core/ufshcd.c +++ b/drivers/ufs/core/ufshcd.c @@ -8171,7 +8171,8 @@ static int ufshcd_abort(struct scsi_cmnd *cmd) * Clear the corresponding bit from outstanding_reqs since the command * has been aborted successfully. */ - if (ufshcd_clear_outstanding_reqs(hba, BIT(tag))) + if (ufshcd_clear_outstanding_reqs(hba, BIT(tag)) && + ufshcd_is_scsi_cmd(cmd)) ufshcd_release_scsi_cmd(hba, cmd); err = SUCCESS;