Re: [PATCH v2 2/2] scsi: leapraid: serialize firmware log mmap with teardown

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Device removal and module unloading can be permanently blocked by a userspace process holding an open memory mapping.
--

--- Patch [2]: [PATCH v2 2/2] scsi: leapraid: serialize firmware log mmap with teardown ---
commit 3180bb0e1579b0aca65c2e7927f3bdc91744a626
Author: Linmao Li <lilinmao@kylinos.cn>

scsi: leapraid: serialize firmware log mmap with teardown

This patch addresses a race condition where a firmware log buffer could be
freed during device removal while a concurrent mmap operation is
establishing a userspace mapping. It claims a temporary mmap reference
while looking up the adapter, and drops it on the exit path.

> diff --git a/drivers/scsi/leapraid/leapraid_app.c b/drivers/scsi/leapraid/leapraid_app.c
> index 841027ce2501c..790a3191e9259 100644
> --- a/drivers/scsi/leapraid/leapraid_app.c
> +++ b/drivers/scsi/leapraid/leapraid_app.c
[ ... ]
> @@ -771,6 +773,9 @@ static int leapraid_fw_mmap(struct file *filp, struct vm_area_struct *vma)
>  
>  	rc = 0;
>  out_put:
> +	if (adapter &&
> +	    atomic_dec_and_test(&adapter->fw_log_desc.mmap_refcnt))
> +		wake_up(&adapter->fw_log_desc.mmap_waitq);

[Severity: High]
This is a pre-existing issue, but can this userspace-controlled reference
count block device removal and module unloading permanently?

Since a userspace process can hold the VMA open indefinitely, and device
removal waits unconditionally in leapraid_fw_log_exit() for the count to
reach zero:

drivers/scsi/leapraid/leapraid_func.c:leapraid_fw_log_exit() {
    ...
    wait_event(adapter->fw_log_desc.mmap_waitq,
               !atomic_read(&adapter->fw_log_desc.mmap_refcnt));
    ...
}

Could a buggy or malicious userspace process that never unmaps the memory
cause the kernel thread handling PCI hotplug or sysfs unbind to hang
forever without a timeout?

>  	leapraid_ctl_put_adapter(adapter);
>  	return rc;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260813072614.1387555-1-lilinmao@kylinos.cn?part=2