Commit b518e86d authored by Mike McGowen's avatar Mike McGowen Committed by Martin K. Petersen
Browse files

scsi: smartpqi: Fix device resources accessed after device removal 



Correct possible race conditions during device removal.

Previously, a scheduled work item to reset a LUN could still execute
after the device was removed, leading to use-after-free and other
resource access issues.

This race condition occurs because the abort handler may schedule a LUN
reset concurrently with device removal via sdev_destroy(), leading to
use-after-free and improper access to freed resources.

  - Check in the device reset handler if the device is still present in
    the controller's SCSI device list before running; if not, the reset
    is skipped.

  - Cancel any pending TMF work that has not started in sdev_destroy().

  - Ensure device freeing in sdev_destroy() is done while holding the
    LUN reset mutex to avoid races with ongoing resets.

Fixes: 2d80f405 ("scsi: smartpqi: Update deleting a LUN via sysfs")
Reviewed-by: default avatarScott Teel <scott.teel@microchip.com>
Reviewed-by: default avatarScott Benesh <scott.benesh@microchip.com>
Signed-off-by: default avatarMike McGowen <mike.mcgowen@microchip.com>
Signed-off-by: default avatarDon Brace <don.brace@microchip.com>
Link: https://patch.msgid.link/20251106163823.786828-3-don.brace@microchip.com


Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent f3ecbba1

drivers/scsi/smartpqi/smartpqi_init.c

+19 −0
Original line number Diff line number Diff line
@@ -6427,10 +6427,22 @@ static int pqi_device_reset(struct pqi_ctrl_info *ctrl_info, struct pqi_scsi_dev 


static int pqi_device_reset_handler(struct pqi_ctrl_info *ctrl_info, struct pqi_scsi_dev *device, u8 lun, struct scsi_cmnd *scmd, u8 scsi_opcode)

{

	unsigned long flags;

	int rc;



	mutex_lock(&ctrl_info->lun_reset_mutex);



	spin_lock_irqsave(&ctrl_info->scsi_device_list_lock, flags);

	if (pqi_find_scsi_dev(ctrl_info, device->bus, device->target, device->lun) == NULL) {

		dev_warn(&ctrl_info->pci_dev->dev,

			"skipping reset of scsi %d:%d:%d:%u, device has been removed\n",

			ctrl_info->scsi_host->host_no, device->bus, device->target, device->lun);

		spin_unlock_irqrestore(&ctrl_info->scsi_device_list_lock, flags);

		mutex_unlock(&ctrl_info->lun_reset_mutex);

		return 0;

	}

	spin_unlock_irqrestore(&ctrl_info->scsi_device_list_lock, flags);



	dev_err(&ctrl_info->pci_dev->dev,

		"resetting scsi %d:%d:%d:%u SCSI cmd at %p due to cmd opcode 0x%02x\n",

		ctrl_info->scsi_host->host_no, device->bus, device->target, lun, scmd, scsi_opcode);
@@ -6611,7 +6623,9 @@ static void pqi_sdev_destroy(struct scsi_device *sdev) 
{

	struct pqi_ctrl_info *ctrl_info;

	struct pqi_scsi_dev *device;

	struct pqi_tmf_work *tmf_work;

	int mutex_acquired;

	unsigned int lun;

	unsigned long flags;



	ctrl_info = shost_to_hba(sdev->host);
@@ -6638,8 +6652,13 @@ static void pqi_sdev_destroy(struct scsi_device *sdev) 


	mutex_unlock(&ctrl_info->scan_mutex);



	for (lun = 0, tmf_work = device->tmf_work; lun < PQI_MAX_LUNS_PER_DEVICE; lun++, tmf_work++)

		cancel_work_sync(&tmf_work->work_struct);



	mutex_lock(&ctrl_info->lun_reset_mutex);

	pqi_dev_info(ctrl_info, "removed", device);

	pqi_free_device(device);

	mutex_unlock(&ctrl_info->lun_reset_mutex);

}



static int pqi_getpciinfo_ioctl(struct pqi_ctrl_info *ctrl_info, void __user *arg)