Re: [PATCH] scsi: esas2r: fix refcount leak in esas2r_resume()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The patch introduces a critical vulnerability in the IRQ claim failure path by blindly calling `esas2r_enable_chip_interrupts()`. Since `esas2r_power_up()` already decremented the `dis_ints_cnt` refcount on its success path, this additional call drops the refcount to 0, which physically unmasks hardware interrupts without a registered OS-level handler.
--

commit bcbf85bebac19683b875da8be0ef4e9cf5ebfcdd
Author: WenTao Liang <vulab@iscas.ac.cn>

scsi: esas2r: fix refcount leak in esas2r_resume()

This commit attempts to fix a refcount leak in esas2r_resume() by calling
esas2r_enable_chip_interrupts() on the error paths.

> diff --git a/drivers/scsi/esas2r/esas2r_init.c b/drivers/scsi/esas2r/esas2r_init.c
> index 0a35f19537680..727ddcebec9f9 100644
> --- a/drivers/scsi/esas2r/esas2r_init.c
> +++ b/drivers/scsi/esas2r/esas2r_init.c

[ ... ]

> @@ -699,6 +700,7 @@ static int __maybe_unused esas2r_resume(struct device *dev)
>  		esas2r_debug("yikes, unable to claim IRQ");
>  		esas2r_log(ESAS2R_LOG_CRIT, "could not re-claim IRQ!");
>  		rez = -ENOMEM;
> +		esas2r_enable_chip_interrupts(a);

[Severity: High]
Does this call to esas2r_enable_chip_interrupts() prematurely drop the
dis_ints_cnt refcount to 0 and physically unmask hardware interrupts?

If esas2r_power_up() succeeded earlier in this function, its internal success
path already decremented the dis_ints_cnt refcount back to 1.

If esas2r_claim_interrupts() subsequently fails to register an IRQ handler and
execution branches to this error path, calling esas2r_enable_chip_interrupts()
again drops the refcount from 1 to 0.

When the counter reaches 0, it writes ESAS2R_INT_ENB_MASK to the hardware
register to unmask interrupts. Since the OS explicitly refused to grant the
IRQ, will any generated hardware interrupt be left unhandled, leading to a
screaming interrupt on shared lines and forcing the kernel to disable the
shared IRQ line?

>  		goto error_exit;
>  	}
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260611064100.65731-1-vulab@iscas.ac.cn?part=1