[PATCH] scsi: aic94xx: Free the IRQ before killing the completion tasklet

[PATCH] scsi: aic94xx: Free the IRQ before killing the completion tasklet

[Myeonghun Pak]

Masking the adapter interrupt does not wait for an interrupt handler
that is already running. Such a handler can schedule dl_tasklet after
tasklet_kill() returns in asd_pci_remove(), leaving the tasklet pending
when the adapter state and done list are freed.

Move free_irq() ahead of tasklet_kill() so the last possible producer is
joined first. Apply the same ordering to probe failures after interrupts
have been enabled; those paths currently never drain dl_tasklet.

This completes the removal ordering added by commit f6ab594672d4 ("scsi:
aic94xx: fix use-after-free in device removal path").

This issue was found by static analysis.

Fixes: 2908d778ab3e ("[SCSI] aic94xx: new driver")
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
---
Compile-tested with GCC, W=1 (arm). No runtime testing.

 drivers/scsi/aic94xx/aic94xx_init.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/aic94xx/aic94xx_init.c b/drivers/scsi/aic94xx/aic94xx_init.c
index 4400a36..89e584c 100644
--- a/drivers/scsi/aic94xx/aic94xx_init.c
+++ b/drivers/scsi/aic94xx/aic94xx_init.c
@@ -810,6 +810,7 @@ static int asd_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
 Err_escbs:
 	asd_disable_ints(asd_ha);
 	free_irq(dev->irq, asd_ha);
+	tasklet_kill(&asd_ha->seq.dl_tasklet);
 Err_irq:
 	if (use_msi)
 		pci_disable_msi(dev);
@@ -881,6 +882,7 @@ static void asd_pci_remove(struct pci_dev *dev)
 	asd_unregister_sas_ha(asd_ha);
 
 	asd_disable_ints(asd_ha);
+	free_irq(dev->irq, asd_ha);
 
 	/* Ensure all scheduled tasklets complete before freeing resources */
 	tasklet_kill(&asd_ha->seq.dl_tasklet);
@@ -889,7 +891,6 @@ static void asd_pci_remove(struct pci_dev *dev)
 
 	/* XXX more here as needed */
 
-	free_irq(dev->irq, asd_ha);
 	if (use_msi)
 		pci_disable_msi(asd_ha->pcidev);
 	asd_turn_off_leds(asd_ha);

Re: [PATCH] scsi: aic94xx: Free the IRQ before killing the completion tasklet

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] scsi: aic94xx: memory leak of sas_phys and sas_ports arrays on probe error
--

commit 06cb328e08d3b300d95f57379c0e6e1c9182cebb
Author: Myeonghun Pak <mhun512@gmail.com>

scsi: aic94xx: Free the IRQ before killing the completion tasklet

This commit changes the teardown order in the aic94xx driver by moving
free_irq() ahead of tasklet_kill(). This ensures that the last possible
producer is joined before killing the completion tasklet in the device
removal and probe error paths.

> diff --git a/drivers/scsi/aic94xx/aic94xx_init.c b/drivers/scsi/aic94xx/aic94xx_init.c
> --- a/drivers/scsi/aic94xx/aic94xx_init.c
> +++ b/drivers/scsi/aic94xx/aic94xx_init.c
> @@ -810,6 +810,7 @@ static int asd_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
>  Err_escbs:
>  	asd_disable_ints(asd_ha);
>  	free_irq(dev->irq, asd_ha);
> +	tasklet_kill(&asd_ha->seq.dl_tasklet);
>  Err_irq:

[Severity: Medium]
Does this error handling path leak the sas_phys and sas_ports arrays?

If sas_register_ha() fails in asd_register_sas_ha(), those arrays are
dynamically allocated but do not appear to be freed before returning an
error:

drivers/scsi/aic94xx/aic94xx_init.c:asd_register_sas_ha() {
        struct asd_sas_phy   **sas_phys =
                kzalloc_objs(*sas_phys, ASD_MAX_PHYS);
        struct asd_sas_port  **sas_ports =
                kzalloc_objs(*sas_ports, ASD_MAX_PHYS);
        ...
        return sas_register_ha(&asd_ha->sas_ha);
}

The asd_pci_probe() function propagates this failure by jumping to
Err_reg_sas, which falls through this code block to eventually free asd_ha.
Could we be missing a kfree() for asd_ha->sas_ha.sas_phy and
asd_ha->sas_ha.sas_port before freeing the main structure?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261011151621.b9b17c998453-1-mhun512@gmail.com?part=1