Re: [PATCH v2 3/3] scsi: mvumi: flush the event work before the host is freed

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Medium] scsi: mvumi: mvumi_release_fw() called before
  pci_disable_device() on error
--

commit 4d0117b39b9433095d582919461757b3980ec9e3
Author: Yehyeong Lee <yhlee@isslab.korea.ac.kr>

scsi: mvumi: flush the event work before the host is freed

This commit gives mvumi a dedicated workqueue for event notifications and
flushes or destroys it during probe failure and device removal before the
host is freed.

> diff --git a/drivers/scsi/mvumi.c b/drivers/scsi/mvumi.c
> index 48652640afc18..f58b29e55a377 100644
> --- a/drivers/scsi/mvumi.c
> +++ b/drivers/scsi/mvumi.c

[ ... ]

> @@ -2560,9 +2567,12 @@ static int mvumi_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
>  fail_io_attach:
>  	mhba->instancet->disable_intr(mhba);
>  	free_irq(mhba->pdev->irq, mhba);
> +	flush_workqueue(mhba->work_q);
>  fail_init_irq:
>  	mvumi_release_fw(mhba);
>  fail_init_fw:
> +	destroy_workqueue(mhba->work_q);
> +fail_alloc_workqueue:
>  	scsi_host_put(host);
>  
>  fail_alloc_instance:

[Severity: Medium]
Does fail_io_attach free quarantined DMA buffers in mvumi_release_fw()
while the controller still has bus-mastering enabled?

Because flush_workqueue(mhba->work_q) runs after free_irq(), any queued
mvumi_scan_events() work times out in mvumi_issue_blocked_cmd(), and
mvumi_delete_internal_cmd() quarantines cmd->data_buf and cmd->frame onto
mhba->res_list to be freed only after pci_disable_device().  However, unlike
mvumi_detach_one(), this error path calls mvumi_release_fw() ->
mvumi_release_mem_resource() before fail_set_dma_mask calls
pci_disable_device(pdev), so dma_free_coherent() returns those buffers and
mhba->handshake_page to the allocator while the controller can still DMA to
them.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261115122153.1446810-1-yhlee@isslab.korea.ac.kr?part=3