From: Damien Le Moal <dlemoal@kernel.org> mainline inclusion from mainline-v7.0-rc1 commit 9a5eb2adb1ec90f854d9b45c75f0fcb3ae981356 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15109 CVE: CVE-2026-45855 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... -------------------------------- In ata_scsi_requeue_deferred_qc(), use ata_qc_done() instead of calling ata_qc_free() and scsi_done() directly. Signed-off-by: Damien Le Moal <dlemoal@kernel.org> Reviewed-by: Hannes Reinecke <hare@suse.de> Signed-off-by: Long Li <leo.lilong@huawei.com> --- drivers/ata/libata-scsi.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c index 6693b75765d5..01622f6a7ac3 100644 --- a/drivers/ata/libata-scsi.c +++ b/drivers/ata/libata-scsi.c @@ -1732,7 +1732,6 @@ void ata_scsi_deferred_qc_work(struct work_struct *work) void ata_scsi_requeue_deferred_qc(struct ata_port *ap) { struct ata_queued_cmd *qc = ap->deferred_qc; - struct scsi_cmnd *scmd; lockdep_assert_held(ap->lock); @@ -1744,11 +1743,9 @@ void ata_scsi_requeue_deferred_qc(struct ata_port *ap) if (!qc) return; - scmd = qc->scsicmd; ap->deferred_qc = NULL; - ata_qc_free(qc); - scmd->result = (DID_SOFT_ERROR << 16); - scsi_done(scmd); + qc->scsicmd->result = (DID_SOFT_ERROR << 16); + ata_qc_done(qc); } static void ata_scsi_schedule_deferred_qc(struct ata_port *ap) -- 2.52.0