scsi: smartpqi: Fix use after free bug in pqi_pci_remove due to race condition
Commit Message
In pqi_pci_probe, it calls pqi_alloc_ctrl_info and bound
&ctrl_info->event_work with pqi_event_worker.
When it calls pqi_irq_handler to handle IRQ,
it will finally call schedule_work to start the work.
When we call pqi_pci_remove to remove the driver, there
may be a sequence as follows:
Fix it by finishing the work before cleanup in pqi_remove_ctrl.
CPU0 CPU1
|pqi_event_worker
pqi_pci_remove |
pqi_remove_ctrl |
pqi_free_ctrl_resources|
pqi_free_ctrl_info|
kfree(ctrl_info) |
//free ctrl_info |
|pqi_ctrl_busy
|//use ctrl_info
Fixes: 6c223761eb54 ("smartpqi: initial commit of Microsemi smartpqi driver")
Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
---
drivers/scsi/smartpqi/smartpqi_init.c | 1 +
1 file changed, 1 insertion(+)
@@ -8939,6 +8939,7 @@ static void pqi_take_ctrl_offline_deferred(struct pqi_ctrl_info *ctrl_info)
pqi_perform_lockup_action();
pqi_stop_heartbeat_timer(ctrl_info);
pqi_free_interrupts(ctrl_info);
+ cancel_work_sync(&ctrl_info->event_work);
pqi_cancel_rescan_worker(ctrl_info);
pqi_cancel_update_time_worker(ctrl_info);
pqi_ctrl_wait_until_quiesced(ctrl_info);