diff options
| author | Stanley Jhu <stanleyjhu@google.com> | 2026-10-15 08:18:51 +0800 |
|---|---|---|
| committer | Martin K. Petersen (Oracle) <mkp@kernel.org> | 2026-10-23 22:35:44 -0400 |
| commit | cc0ce3fe8fac073ecded4f32c8ee5b89da1397e8 (patch) | |
| tree | 726d3b66e6c9cd18a36386a457b0296f918b2543 | |
| parent | cee9395acd8043be0644b25c34bfa86623f2b935 (diff) | |
| download | linux-cc0ce3fe8fac073ecded4f32c8ee5b89da1397e8.tar.gz linux-cc0ce3fe8fac073ecded4f32c8ee5b89da1397e8.zip | |
scsi: ufs: bsg: Complete the job on error
When ufs_bsg_request() fails, it returns a non-zero status without calling
bsg_job_done(). bsg_queue_rq() then ends the request with BLK_STS_IOERR
without running bsg_complete(), leaking the job's device reference and
mapped scatterlists.
Always complete the job via bsg_job_done() and return 0, matching other BSG
transports. Requests failing with a negative errno now return it from SG_IO
with the 4-byte result in the reply, while positive status codes still
return 0 from SG_IO with the reply header.
Fixes: b13a3539eb2a ("scsi: ufs-bsg: complete ufs-bsg job only if no error")
Cc: stable@vger.kernel.org
Signed-off-by: Stanley Jhu <stanleyjhu@google.com>
Reviewed-by: Bean Huo <beanhuo@micron.com>
Reviewed-by: Peter Wang <peter.wang@mediatek.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/20261015001855.3450573-2-stanleyjhu@google.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
| -rw-r--r-- | drivers/ufs/core/ufs_bsg.c | 8 |
1 files changed, 3 insertions, 5 deletions
diff --git a/drivers/ufs/core/ufs_bsg.c b/drivers/ufs/core/ufs_bsg.c index 7a66917b3fc0..18c318d78122 100644 --- a/drivers/ufs/core/ufs_bsg.c +++ b/drivers/ufs/core/ufs_bsg.c @@ -195,14 +195,12 @@ out: ufshcd_rpm_put_sync(hba); kfree(buff); bsg_reply->result = ret; - /* complete the job here only if no error */ - if (ret == 0) { + if (ret == 0) job->reply_len = rpmb ? sizeof(struct ufs_rpmb_reply) : sizeof(struct ufs_bsg_reply); - bsg_job_done(job, ret, bsg_reply->reply_payload_rcv_len); - } + bsg_job_done(job, ret, bsg_reply->reply_payload_rcv_len); - return ret; + return 0; } /** |