Re: [PATCH] scsi: pm8001: Fix potential TOCTOU race in pm8001_find_tag

[James Bottomley <James.Bottomley@HansenPartnership.com>]

On Sat, 2026-01-17 at 10:19 +0000, Chengfeng Ye wrote:
> A potential time-of-check-time-of-use (TOCTOU) race condition in
> pm8001_find_tag() where task->lldd_task is checked for non-NULL
> and then dereferenced without synchronization to ensure atomicity.
> 
> Since the check of NULL and dereference in pm8001_find_tag() is not
> executed atomically, a race could occur if the callback is executed
> in
> response to an error or timeout on a SAS task issued from the SCSI
> midlayer, while the SAS command is completed and calls
> pm8001_ccb_task_free(), which sets task->lldd_task to NULL, resulting
> in a null pointer being dereferenced in pm8001_find_tag().
> 
> Possible race scenario:
>  CPU0 (Error Handler)           CPU1 (Interrupt Handler)
>   --------------------           ------------------------
>   [SCSI command timeout/error]
>   sas_scsi_recover_host()
>     sas_scsi_find_task()
>       lldd_query_task()
>         pm8001_query_task()
>           pm8001_find_tag()
>             if (task->lldd_task)
>                                    [Hardware interrupt]
>                                      mpi_ssp_completion()
>                                        pm8001_ccb_task_free()
>                                          task->lldd_task = NULL
>             ccb = task->lldd_task
>             *tag = ccb->ccb_tag
>             <- NULL dereference
> 

I don't get how a race is possible here.  Before the query function
begins, the sas logic calls abort task on the tag, which means the
controller should ensure there are no further completion functions for
it regardless of whether the abort succeeds or not.

Regards,

James