static void hisi_sas_tmf_timedout(unsigned long data)
 {
        struct sas_task *task = (struct sas_task *)data;
+       unsigned long flags;
+
+       spin_lock_irqsave(&task->task_state_lock, flags);
+       if (!(task->task_state_flags & SAS_TASK_STATE_DONE))
+               task->task_state_flags |= SAS_TASK_STATE_ABORTED;
+       spin_unlock_irqrestore(&task->task_state_lock, flags);
 
-       task->task_state_flags |= SAS_TASK_STATE_ABORTED;
        complete(&task->slow_task->completion);
 }
 
        wait_for_completion(&task->slow_task->completion);
        res = TMF_RESP_FUNC_FAILED;
 
+       /* Internal abort timed out */
+       if ((task->task_state_flags & SAS_TASK_STATE_ABORTED)) {
+               if (!(task->task_state_flags & SAS_TASK_STATE_DONE)) {
+                       struct hisi_sas_slot *slot = task->lldd_task;
+
+                       if (slot)
+                               slot->task = NULL;
+                       dev_err(dev, "internal task abort: timeout.\n");
+               }
+       }
+
        if (task->task_status.resp == SAS_TASK_COMPLETE &&
                task->task_status.stat == TMF_RESP_FUNC_COMPLETE) {
                res = TMF_RESP_FUNC_COMPLETE;
                goto exit;
        }
 
-       /* Internal abort timed out */
-       if ((task->task_state_flags & SAS_TASK_STATE_ABORTED)) {
-               if (!(task->task_state_flags & SAS_TASK_STATE_DONE)) {
-                       dev_err(dev, "internal task abort: timeout.\n");
-               }
-       }
-
 exit:
        dev_dbg(dev, "internal task abort: task to dev %016llx task=%p "
                "resp: 0x%x sts 0x%x\n",