sugar/linux
1
0
Fork 0
Code Activity

scsi: smartpqi: Fix device resources accessed after device removal

Browse Source 
Correct possible race conditions during device removal.

Previously, a scheduled work item to reset a LUN could still execute
after the device was removed, leading to use-after-free and other
resource access issues.

This race condition occurs because the abort handler may schedule a LUN
reset concurrently with device removal via sdev_destroy(), leading to
use-after-free and improper access to freed resources.

  - Check in the device reset handler if the device is still present in
    the controller's SCSI device list before running; if not, the reset
    is skipped.

  - Cancel any pending TMF work that has not started in sdev_destroy().

  - Ensure device freeing in sdev_destroy() is done while holding the
    LUN reset mutex to avoid races with ongoing resets.

Fixes: 2d80f4054f ("scsi: smartpqi: Update deleting a LUN via sysfs")
Reviewed-by: Scott Teel <scott.teel@microchip.com>
Reviewed-by: Scott Benesh <scott.benesh@microchip.com>
Signed-off-by: Mike McGowen <mike.mcgowen@microchip.com>
Signed-off-by: Don Brace <don.brace@microchip.com>
Link: https://patch.msgid.link/20251106163823.786828-3-don.brace@microchip.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
This commit is contained in:
Mike McGowen
2025-11-06 10:38:20 -06:00
committed by Martin K. Petersen
parent f3ecbba1aa
commit b518e86d1a
1 changed files with 19 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
drivers/scsi/smartpqi/smartpqi_init.c
View File

@@ -6427,10 +6427,22 @@ static int pqi_device_reset(struct pqi_ctrl_info *ctrl_info, struct pqi_scsi_dev
static int pqi_device_reset_handler(struct pqi_ctrl_info *ctrl_info, struct pqi_scsi_dev *device, u8 lun, struct scsi_cmnd *scmd, u8 scsi_opcode)
{
unsigned long flags;
int rc;
mutex_lock(&ctrl_info->lun_reset_mutex);
spin_lock_irqsave(&ctrl_info->scsi_device_list_lock, flags);
if (pqi_find_scsi_dev(ctrl_info, device->bus, device->target, device->lun) == NULL) {
dev_warn(&ctrl_info->pci_dev->dev,
"skipping reset of scsi %d:%d:%d:%u, device has been removed\n",
ctrl_info->scsi_host->host_no, device->bus, device->target, device->lun);
spin_unlock_irqrestore(&ctrl_info->scsi_device_list_lock, flags);
mutex_unlock(&ctrl_info->lun_reset_mutex);
return 0;
}
spin_unlock_irqrestore(&ctrl_info->scsi_device_list_lock, flags);
dev_err(&ctrl_info->pci_dev->dev,
"resetting scsi %d:%d:%d:%u SCSI cmd at %p due to cmd opcode 0x%02x\n",
ctrl_info->scsi_host->host_no, device->bus, device->target, lun, scmd, scsi_opcode);
@@ -6611,7 +6623,9 @@ static void pqi_sdev_destroy(struct scsi_device *sdev)
{
struct pqi_ctrl_info *ctrl_info;
struct pqi_scsi_dev *device;
struct pqi_tmf_work *tmf_work;
int mutex_acquired;
unsigned int lun;
unsigned long flags;
ctrl_info = shost_to_hba(sdev->host);
@@ -6638,8 +6652,13 @@ static void pqi_sdev_destroy(struct scsi_device *sdev)
mutex_unlock(&ctrl_info->scan_mutex);
for (lun = 0, tmf_work = device->tmf_work; lun < PQI_MAX_LUNS_PER_DEVICE; lun++, tmf_work++)
cancel_work_sync(&tmf_work->work_struct);
mutex_lock(&ctrl_info->lun_reset_mutex);
pqi_dev_info(ctrl_info, "removed", device);
pqi_free_device(device);
mutex_unlock(&ctrl_info->lun_reset_mutex);
}
static int pqi_getpciinfo_ioctl(struct pqi_ctrl_info *ctrl_info, void __user *arg)