On Wed, 23 Sep 2026 11:03:01 +0900, Jeuk Kim <[email protected]> wrote:
ufs_clear_req() currently releases request resources; it is not
responsible
for cancelling in-flight SCSI requests. Its existing callers ensure that
the request is no longer in flight, so the current code does not have the
UAF described here. Please describe this as preparation for TMF support.
Agreed. Updated the commit message in v3 to frame this as preparation
for TMF support.
> + if (!req) {
> + return;
> + }
Can we use assert(req != NULL) here? We only clear hba_private in the
completion and cancellation callbacks, so req should not be NULL here.
If that invariant is broken, it would be better to catch the bug with
an assertion than to silently return.
> @@ -190,6 +196,11 @@ static void ufs_scsi_command_complete(SCSIRequest
*scsi_req, size_t resid)
>
> static void ufs_scsi_command_cancelled(SCSIRequest *scsi_req)
> {
> + UfsRequest *req = scsi_req->hba_private;
> +
> + if (req) {
Same here: can we use assert(req != NULL)?
Done in v3.
