Re: [PATCH 33/37] scsi: storvsc: use 16-bits defined sense codes

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Use-After-Free when an asynchronous I/O completion enqueues work onto a destroyed workqueue during device removal.
--

commit d0f50a340823cdbe80b900f5e21694a095dae714
Author: Damien Le Moal <dlemoal@kernel.org>

scsi: storvsc: use 16-bits defined sense codes

This refactors the storvsc driver to use the 16-bits sense_code field of
struct scsi_sense_hdr. It replaces hard-coded additional sense codes with
the enum values defined in include/scsi/scsi_sense.h to improve code
clarity.

> diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
> index ef3cd3bc7390e..625db97d1a03e 100644
> --- a/drivers/scsi/storvsc_drv.c
> +++ b/drivers/scsi/storvsc_drv.c
[ ... ]
> @@ -1033,7 +1033,7 @@ static void storvsc_handle_error(struct vmscsi_request *vm_srb,
>  	case SRB_STATUS_DATA_OVERRUN:
>  		if (vm_srb->srb_status & SRB_STATUS_AUTOSENSE_VALID) {
>  			/* Check for capacity change */
> -			if ((asc == 0x2a) && (ascq == 0x9)) {
> +			if (sshdr->sense_code == CAPACITY_DATA_HAS_CHANGED) {
>  				process_err_fn = storvsc_device_scan;
>  				/* Retry the I/O that triggered this. */
>  				set_host_byte(scmnd, DID_REQUEUE);
>  				goto do_work;

[Severity: High]
This isn't a bug introduced by this patch, but can this lead to a
use-after-free during device removal?

In storvsc_remove(), the driver destroys the workqueue before stopping the
VMBus channel and draining outstanding requests:

drivers/scsi/storvsc_drv.c:storvsc_remove() {
    ...
    destroy_workqueue(host_dev->handle_error_wq);
    scsi_remove_host(host);
    storvsc_dev_remove(dev);
    ...
}

If an asynchronous I/O completion indicating a capacity change arrives after
this point, it will call storvsc_handle_error(), take this goto do_work
path, and blindly enqueue work onto the destroyed workqueue:

drivers/scsi/storvsc_drv.c:storvsc_handle_error() {
    ...
do_work:
    ...
    queue_work(host_dev->handle_error_wq, &wrk->work);
}

>  			}
[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260831020451.585944-1-dlemoal@kernel.org?part=33