Re: [PATCH v3 44/57] scsi: pm8001: Enable lock context analysis

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Early returns in `mpi_sata_completion` for internal tasks bypass the `SAS_TASK_STATE_ABORTED` check, leading to a Use-After-Free if the task was concurrently aborted.
--

--- Patch [44]: [PATCH v3 44/57] scsi: pm8001: Enable lock context analysis ---
commit 33ee7fcaec7784e599b990132a4a4b4063d0bddb
Author: Bart Van Assche <bvanassche@acm.org>

scsi: pm8001: Enable lock context analysis

This commit enables lock context analysis for the pm8001 driver. It also
documents locking requirements with __must_hold() for mpi_sata_completion()
and process_one_iomb().

> diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
> index 2c0fa7ab33d22..11f6fa5c9771e 100644
> --- a/drivers/scsi/pm8001/pm80xx_hwi.c
> +++ b/drivers/scsi/pm8001/pm80xx_hwi.c
> @@ -2294,6 +2294,7 @@ static void mpi_ssp_event(struct pm8001_hba_info *pm8001_ha, void *piomb)
>  static void
>  mpi_sata_completion(struct pm8001_hba_info *pm8001_ha,
>  		struct outbound_queue_table *circularQ, void *piomb)
> +	__must_hold(&circularQ->oq_lock)
>  {
>  	struct sas_task *t;
>  	struct pm8001_ccb_info *ccb;

[Severity: High]
This is a pre-existing issue, but does this function have a use-after-free
if an internal task is concurrently aborted?

If a SATA internal task (where !t->uldd_task) times out, the libsas EH
handler can set SAS_TASK_STATE_ABORTED under the task_state_lock, complete
the task, and free it.

If the device concurrently completes the task with an error,
mpi_sata_completion() checks !t->uldd_task and returns early after calling
pm8001_ccb_task_free_done().

This early return bypasses the task_state_lock synchronization and the check
for SAS_TASK_STATE_ABORTED at the end of the function, which blindly executes
task->task_done(task) on a potentially freed task.

This issue also appears to exist in mpi_sata_completion() in
drivers/scsi/pm8001/pm8001_hwi.c.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1785451174.git.bvanassche@acm.org?part=44