Re: [PATCH 1/2] scsi: mvumi: stop the controller bus-mastering before freeing its buffers

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [Critical] scsi: mvumi: use-after-free in mvumi_scan_events() [1]
--

commit 6112f67dbb3f3b038c8e964976da10c7659388c5
Author: Yehyeong Lee <yhlee@isslab.korea.ac.kr>

scsi: mvumi: stop the controller bus-mastering before freeing its buffers

This commit moves pci_disable_device() ahead of mvumi_release_fw() and
scsi_host_put() in mvumi_detach_one() so bus-mastering is disabled before
freeing the controller's buffers.

> diff --git a/drivers/scsi/mvumi.c b/drivers/scsi/mvumi.c
> index 91c2db697c691..8d22d370d8608 100644
> --- a/drivers/scsi/mvumi.c
> +++ b/drivers/scsi/mvumi.c
> @@ -2548,9 +2548,9 @@ static void mvumi_detach_one(struct pci_dev *pdev)
>  
>  	mhba->instancet->disable_intr(mhba);
>  	free_irq(mhba->pdev->irq, mhba);
> +	pci_disable_device(pdev);
>  	mvumi_release_fw(mhba);
>  	scsi_host_put(host);
> -	pci_disable_device(pdev);

[Severity: Critical]
This problem wasn't introduced by this patch, but can mvumi_scan_events()
race with mvumi_detach_one() [1] and cause a use-after-free on mhba?

When an interrupt fires, mvumi_launch_events() allocates an mvumi_events
work item and schedules mvumi_scan_events() on the system workqueue.
mvumi_detach_one() frees the IRQ and drops the last reference to host
(which contains mhba) via scsi_host_put() without flushing or cancelling
pending event work items:

CPU0                              CPU1 (kworker)
mvumi_detach_one()
  free_irq(mhba->pdev->irq, mhba)
  mvumi_release_fw(mhba)
  scsi_host_put(host)
                                  mvumi_scan_events()
                                    mvumi_get_event(mu_ev->mhba, ...)
                                      <-- use-after-free

Flushing the scheduled event work after free_irq() and before tearing
down mhba and calling scsi_host_put() would avoid this.

[1] https://sashiko.dev/#/bug/linux-dec460b7-008c-478a-8da9-a7f1503e9e30

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261114014430.489668-1-yhlee@isslab.korea.ac.kr?part=1