| Message ID | 20230312164806.2104140-1-zyytlz.wz@163.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | scsi: smartpqi: Fix use after free bug in pqi_pci_remove due to race condition | expand |
diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c index 49a8f91810b6..555f1af38f38 100644 --- a/drivers/scsi/smartpqi/smartpqi_init.c +++ b/drivers/scsi/smartpqi/smartpqi_init.c @@ -8939,6 +8939,7 @@ static void pqi_take_ctrl_offline_deferred(struct pqi_ctrl_info *ctrl_info) pqi_perform_lockup_action(); pqi_stop_heartbeat_timer(ctrl_info); pqi_free_interrupts(ctrl_info); + cancel_work_sync(&ctrl_info->event_work); pqi_cancel_rescan_worker(ctrl_info); pqi_cancel_update_time_worker(ctrl_info); pqi_ctrl_wait_until_quiesced(ctrl_info);
In pqi_pci_probe, it calls pqi_alloc_ctrl_info and bound &ctrl_info->event_work with pqi_event_worker. When it calls pqi_irq_handler to handle IRQ, it will finally call schedule_work to start the work. When we call pqi_pci_remove to remove the driver, there may be a sequence as follows: Fix it by finishing the work before cleanup in pqi_remove_ctrl. CPU0 CPU1 |pqi_event_worker pqi_pci_remove | pqi_remove_ctrl | pqi_free_ctrl_resources| pqi_free_ctrl_info| kfree(ctrl_info) | //free ctrl_info | |pqi_ctrl_busy |//use ctrl_info Fixes: 6c223761eb54 ("smartpqi: initial commit of Microsemi smartpqi driver") Signed-off-by: Zheng Wang <zyytlz.wz@163.com> --- drivers/scsi/smartpqi/smartpqi_init.c | 1 + 1 file changed, 1 insertion(+)