scsi: leapraid: Serialize firmware log mmap with teardown

Browse source

leapraid_fw_log_exit() waits for mmap_refcnt to reach zero before it frees
the firmware log buffer.  leapraid_fw_mmap() checks host_removing, but it
does not increment mmap_refcnt until after dma_mmap_coherent() succeeds and
the VMA open callback runs.

Removal can set host_removing and observe a zero mmap_refcnt between the
check and the VMA open.  It can then free the coherent buffer while the
mmap path is still establishing a userspace mapping of it.

Claim a temporary mmap reference while looking up the adapter under
leapraid_adapter_lock.  Removal deletes the adapter from the same locked
list after setting host_removing, so a mapping is either rejected or
included in the count that removal waits for.  Drop the temporary reference
on the common exit path, after a successful VMA open has acquired the
reference covering the VMA lifetime.

Fixes: 5597088c9e ("scsi: leapraid: Add new SCSI driver")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Reviewed-by: Dongdong Hao <doubled@leap-io-kernel.com>
Link: https://patch.msgid.link/20260814033845.2971706-3-lilinmao@kylinos.cn
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>

...

This commit is contained in:

Linmao Li 2026-08-14 11:38:45 +08:00 • committed by Martin K. Petersen (Oracle)

parent 970f69b6bf

commit 00b7c8d4ce

1 changed files with 9 additions and 3 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

12

drivers/scsi/leapraid/leapraid_app.c

View file