kernel.git/drivers/scsi/mvsas/mv_init.c, branch linux-rolling-stable

scsi: mvsas: Fix use-after-free bugs in mvs_work_queue

2025-10-19T14:37:07Z

[ Upstream commit 60cd16a3b7439ccb699d0bf533799eeb894fd217 ] During the detaching of Marvell's SAS/SATA controller, the original code calls cancel_delayed_work() in mvs_free() to cancel the delayed work item mwq->work_q. However, if mwq->work_q is already running, the cancel_delayed_work() may fail to cancel it. This can lead to use-after-free scenarios where mvs_free() frees the mvs_info while mvs_work_queue() is still executing and attempts to access the already-freed mvs_info. A typical race condition is illustrated below: CPU 0 (remove) | CPU 1 (delayed work callback) mvs_pci_remove() | mvs_free() | mvs_work_queue() cancel_delayed_work() | kfree(mvi) | | mvi-> // UAF Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure that the delayed work item is properly canceled and any executing delayed work item completes before the mvs_info is deallocated. This bug was found by static analysis. Fixes: 20b09c2992fe ("[SCSI] mvsas: add support for 94xx; layout change; bug fixes") Signed-off-by: Duoming Zhou Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin

scsi: Constify struct pci_device_id

2024-12-10T02:59:52Z

'struct pci_device_id' is not modified in these drivers. Constifying this structure moves some data to a read-only section, so increase overall security. On a x86_64, with allmodconfig, as an example: Before: ====== text data bss dec hex filename 70237 9137 320 79694 1374e drivers/scsi/3w-9xxx.o After: ===== text data bss dec hex filename 70461 8913 320 79694 1374e drivers/scsi/3w-9xxx.o Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/fc61b1946488c1ea8f7a17a06cf40fbd05dcc6de.1733590049.git.christophe.jaillet@wanadoo.fr Signed-off-by: Martin K. Petersen

Merge tag 'driver-core-6.10-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core

2024-05-22T19:13:40Z

Pull driver core updates from Greg KH: "Here is the small set of driver core and kernfs changes for 6.10-rc1. Nothing major here at all, just a small set of changes for some driver core apis, and minor fixups. Included in here are: - sysfs_bin_attr_simple_read() helper added and used - device_show_string() helper added and used All usages of these were acked by the various maintainers. Also in here are: - kernfs minor cleanup - removed unused functions - typo fix in documentation - pay attention to sysfs_create_link() failures in module.c finally All of these have been in linux-next for a very long time with no reported problems" * tag 'driver-core-6.10-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: device property: Fix a typo in the description of device_get_child_node_count() kernfs: mount: Remove unnecessary ‘NULL’ values from knparent scsi: Use device_show_string() helper for sysfs attributes platform/x86: Use device_show_string() helper for sysfs attributes perf: Use device_show_string() helper for sysfs attributes IB/qib: Use device_show_string() helper for sysfs attributes hwmon: Use device_show_string() helper for sysfs attributes driver core: Add device_show_string() helper for sysfs attributes treewide: Use sysfs_bin_attr_simple_read() helper sysfs: Add sysfs_bin_attr_simple_read() helper module: don't ignore sysfs_create_link() failures driver core: Remove unused platform_notify, platform_notify_remove

scsi: Use device_show_string() helper for sysfs attributes

2024-05-04T15:37:04Z

Deduplicate sysfs ->show() callbacks which expose a string at a static memory location. Use the newly introduced device_show_string() helper in the driver core instead by declaring those sysfs attributes with DEVICE_STRING_ATTR_RO(). No functional change intended. Signed-off-by: Lukas Wunner Link: https://lore.kernel.org/r/b11792137186f5a6794f12fdf891d0c6d51b3557.1713608122.git.lukas@wunner.de Signed-off-by: Greg Kroah-Hartman

Merge patch series "Add LIBSAS_SHT_BASE for libsas"

2024-03-25T20:09:36Z

John Garry says: There is much duplication in the scsi_host_template structure for the drivers which use libsas. Similar to how a standard template is used in libata with __ATA_BASE_SHT, create a standard template in LIBSAS_SHT_BASE. Link: https://lore.kernel.org/r/20240308114339.1340549-1-john.g.garry@oracle.com Signed-off-by: Martin K. Petersen

scsi: mvsas: Use LIBSAS_SHT_BASE

2024-03-25T20:08:30Z

Use standard template for scsi_host_template structure to reduce duplication. Signed-off-by: John Garry Link: https://lore.kernel.org/r/20240308114339.1340549-6-john.g.garry@oracle.com Reviewed-by: Igor Pylypiv Reviewed-by: Jason Yan Signed-off-by: Martin K. Petersen

scsi: mvsas: Add libsas SATA sysfs attributes group

2024-03-25T20:00:07Z

The added sysfs attributes group enables the configuration of NCQ Priority feature for HBAs that rely on libsas to manage SATA devices. Reviewed-by: John Garry Reviewed-by: Damien Le Moal Reviewed-by: Jason Yan Reviewed-by: Hannes Reinecke Signed-off-by: Igor Pylypiv Link: https://lore.kernel.org/r/20240307214418.3812290-5-ipylypiv@google.com Reviewed-by: Niklas Cassel Signed-off-by: Martin K. Petersen

scsi: libsas: Delete struct scsi_core

2023-08-21T21:50:58Z

Since commit 79855d178557 ("libsas: remove task_collector mode"), struct scsi_core only contains a reference to the shost. struct scsi_core is only used in sas_ha_struct.core, so delete scsi_core and replace with a reference to the shost there. Signed-off-by: John Garry Link: https://lore.kernel.org/r/20230815115156.343535-5-john.g.garry@oracle.com Reviewed-by: Jason Yan Reviewed-by: Damien Le Moal Signed-off-by: Martin K. Petersen

scsi: libsas: Delete enum sas_phy_type

2023-08-21T21:50:57Z

enum sas_phy_type is used for asd_sas_phy.type, which is only ever set, so delete this member and the enum. Signed-off-by: John Garry Link: https://lore.kernel.org/r/20230815115156.343535-4-john.g.garry@oracle.com Reviewed-by: Damien Le Moal Reviewed-by: Jason Yan Signed-off-by: Martin K. Petersen

scsi: libsas: Delete enum sas_class

2023-08-21T21:50:57Z

enum sas_class prob would have been useful if function sas_show_class() was ever implemented, which it wasn't. enum sas_class is used as asd_sas_port.class and asd_sas_phy.class, which are only ever set, so delete these members and the enum. Signed-off-by: John Garry Link: https://lore.kernel.org/r/20230815115156.343535-3-john.g.garry@oracle.com Reviewed-by: Damien Le Moal Reviewed-by: Jason Yan Signed-off-by: Martin K. Petersen