Re: [PATCH v6 33/40] scsi: storvsc: use 16-bits defined sense codes

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Use-After-Free of handle_error_wq when queuing work during device removal
--

commit 35e07dc6633ea8d87cbeafdfe7c19ba41602369c
Author: Damien Le Moal <dlemoal@kernel.org>

scsi: storvsc: use 16-bits defined sense codes

This commit refactors the storvsc driver to use the 16-bit sense_code field
of struct scsi_sense_hdr. It replaces hard-coded additional sense codes and
qualifiers with enum values from include/scsi/scsi_sense.h to improve code
clarity.

> diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
> index ef3cd3bc7390e..625db97d1a03e 100644
> --- a/drivers/scsi/storvsc_drv.c
> +++ b/drivers/scsi/storvsc_drv.c
> @@ -1016,7 +1016,7 @@ static int storvsc_channel_init(struct hv_device *device, bool is_fc)
>  static void storvsc_handle_error(struct vmscsi_request *vm_srb,
>  				struct scsi_cmnd *scmnd,
>  				struct Scsi_Host *host,
> -				u8 asc, u8 ascq)
> +				struct scsi_sense_hdr *sshdr)
>  {

[Severity: High]
This is a pre-existing issue, but is it possible for a use-after-free to
occur here if work is queued during device removal?

Looking at the teardown path:

storvsc_remove()
    ...
    destroy_workqueue(host_dev->handle_error_wq);
    scsi_remove_host(host);
    storvsc_dev_remove(dev);

The workqueue is destroyed before the VMBus channel is closed in
storvsc_dev_remove(). Because the channel remains active during this window,
could concurrent events trigger a queue_work() on the freed workqueue?

For example, if an outstanding I/O completes with an error while
scsi_remove_host() is waiting for commands to finish, it appears
storvsc_command_completion() will call storvsc_handle_error(), which then
queues work:

storvsc_handle_error()
    ...
do_work:
    ...
    queue_work(host_dev->handle_error_wq, &wrk->work);

Similarly, could an unsolicited VSTOR_OPERATION_REMOVE_DEVICE message
received from the host during this same window cause storvsc_on_receive()
to queue work on the freed handle_error_wq pointer?

>  	struct storvsc_scan_work *wrk;
>  	void (*process_err_fn)(struct work_struct *work);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260908090308.1085097-1-dlemoal@kernel.org?part=33