Sandro/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-09-18 23:09:29 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

scsi: leapraid: Serialize firmware log mmap with teardown

Browse Source 
leapraid_fw_log_exit() waits for mmap_refcnt to reach zero before it frees
the firmware log buffer.  leapraid_fw_mmap() checks host_removing, but it
does not increment mmap_refcnt until after dma_mmap_coherent() succeeds and
the VMA open callback runs.

Removal can set host_removing and observe a zero mmap_refcnt between the
check and the VMA open.  It can then free the coherent buffer while the
mmap path is still establishing a userspace mapping of it.

Claim a temporary mmap reference while looking up the adapter under
leapraid_adapter_lock.  Removal deletes the adapter from the same locked
list after setting host_removing, so a mapping is either rejected or
included in the count that removal waits for.  Drop the temporary reference
on the common exit path, after a successful VMA open has acquired the
reference covering the VMA lifetime.

Fixes: 5597088c9e ("scsi: leapraid: Add new SCSI driver")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Reviewed-by: Dongdong Hao <doubled@leap-io-kernel.com>
Link: https://patch.msgid.link/20260814033845.2971706-3-lilinmao@kylinos.cn
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
This commit is contained in:
Linmao Li
2026-08-23 21:51:43 -04:00
committed by Martin K. Petersen (Oracle)
parent 970f69b6bf
commit 00b7c8d4ce
1 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/scsi/leapraid/leapraid_app.c
+9 -3
View File
@@ -171,7 +171,8 @@ static int leapraid_ctl_validate_sge_offset(struct leapraid_adapter *adapter,
return 0;
}
static struct leapraid_adapter *leapraid_ctl_lookup_adapter(int adapter_id)
static struct leapraid_adapter *leapraid_ctl_lookup_adapter(int adapter_id,
bool track_mmap)
{
struct leapraid_adapter *adapter;
struct Scsi_Host *shost;
@@ -184,6 +185,8 @@ static struct leapraid_adapter *leapraid_ctl_lookup_adapter(int adapter_id)
shost = adapter->shost;
if (!shost || !scsi_host_get(shost))
break;
if (track_mmap)
atomic_inc(&adapter->fw_log_desc.mmap_refcnt);
spin_unlock(&leapraid_adapter_lock);
return adapter;
}
@@ -589,7 +592,7 @@ static int leapraid_ctl_ioctl_main(struct file *file, unsigned int cmd,
return -EFAULT;
}
adapter = leapraid_ctl_lookup_adapter(ioctl_header.adapter_id);
adapter = leapraid_ctl_lookup_adapter(ioctl_header.adapter_id, false);
if (!adapter)
return -EFAULT;
@@ -728,7 +731,7 @@ static int leapraid_fw_mmap(struct file *filp, struct vm_area_struct *vma)
length = vma->vm_end - vma->vm_start;
adapter = leapraid_ctl_lookup_adapter(adapter_id);
adapter = leapraid_ctl_lookup_adapter(adapter_id, true);
if (!adapter) {
pr_err("%s: No adapter found!\n", __func__);
return -EINVAL;
@@ -771,6 +774,9 @@ static int leapraid_fw_mmap(struct file *filp, struct vm_area_struct *vma)
rc = 0;
out_put:
if (adapter &&
atomic_dec_and_test(&adapter->fw_log_desc.mmap_refcnt))
wake_up(&adapter->fw_log_desc.mmap_waitq);
leapraid_ctl_put_adapter(adapter);
return rc;
}