kernel/linux.git/drivers/scsi/isci, branch linux-7.1.y

scsi: isci: Fix use-after-free in device removal path

2026-05-15T02:14:13+00:00

The ISCI completion tasklet is initialized in isci_host_alloc() (drivers/scsi/isci/init.c:496) and scheduled from both MSI-X and legacy interrupt handlers (drivers/scsi/isci/host.c:223,613). isci_host_deinit() stops the controller and waits for stop completion, but it never kills completion_tasklet before teardown continues. A top-of-function tasklet_kill() is not sufficient here: interrupts are only disabled when isci_host_stop_complete() runs, so until wait_for_stop() returns the IRQ handlers can still requeue the tasklet. The tasklet callback also re-enables interrupts after draining completions, so killing the tasklet before the source is quiesced leaves the same race open. Once wait_for_stop() returns, no further IRQ-driven scheduling can occur. Kill completion_tasklet there so teardown cannot race a queued tasklet running on a dead ihost. On remove or unload, the stale callback can otherwise dereference ihost and touch ihost->smu_registers after the host lifetime ends. A UML + KASAN analogue reproduced the failure class both with no tasklet_kill() and with tasklet_kill() placed before source quiesce, and stayed clean once the kill happened after quiescing the scheduling source. This mirrors commit f6ab594672d4 ("scsi: aic94xx: fix use-after-free in device removal path"), but ISCI needs the kill after wait_for_stop(). Fixes: 6f231dda6808 ("isci: Intel(R) C600 Series Chipset Storage Control Unit Driver") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Assisted-by: Codex:gpt-5-4 Signed-off-by: Michael Bommarito Link: https://patch.msgid.link/20260419210420.2134639-1-michael.bommarito@gmail.com Signed-off-by: Martin K. Petersen

scsi: isci: Avoid -Wflex-array-member-not-at-end warning

2025-10-20T16:00:11+00:00

-Wflex-array-member-not-at-end was introduced in GCC-14, and we are getting ready to enable it, globally. Move the conflicting declaration (which happens to be in a union, so we're moving the entire union) to the end of the corresponding structure. Notice that `struct ssp_response_iu` is a flexible structure, this is a structure that contains a flexible-array member. With these changes fix the following warning: drivers/scsi/isci/task.h:92:11: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] Signed-off-by: Gustavo A. R. Silva Link: https://patch.msgid.link/aM09bpl1xj9KZSZl@kspp Signed-off-by: Martin K. Petersen

scsi: isci: Use dev_parent_is_expander() helper

2025-08-19T02:08:30+00:00

Make use of the dev_parent_is_expander() helper. Signed-off-by: Niklas Cassel Link: https://lore.kernel.org/r/20250814173215.1765055-17-cassel@kernel.org Reviewed-by: Damien Le Moal Reviewed-by: John Garry Signed-off-by: Martin K. Petersen

scsi: isci: Fix dma_unmap_sg() nents value

2025-07-15T00:57:25+00:00

The dma_unmap_sg() functions should be called with the same nents as the dma_map_sg(), not the value the map function returned. Fixes: ddcc7e347a89 ("isci: fix dma_unmap_sg usage") Signed-off-by: Thomas Fourier Link: https://lore.kernel.org/r/20250627142451.241713-2-fourier.thomas@gmail.com Signed-off-by: Martin K. Petersen

treewide, timers: Rename from_timer() to timer_container_of()

2025-06-08T07:07:37+00:00

Move this API to the canonical timer_*() namespace. [ tglx: Redone against pre rc1 ] Signed-off-by: Ingo Molnar Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/aB2X0jCKQO56WdMt@gmail.com

scsi: isci: Remove unused sci_remote_device_reset()

2025-05-13T02:11:55+00:00

sci_remote_device_reset() last use was removed in 2012 by commit 14aaa9f0a318 ("isci: Redesign device suspension, abort, cleanup.") Remove it. Signed-off-by: Dr. David Alan Gilbert Link: https://lore.kernel.org/r/20250503230601.124794-1-linux@treblig.org Signed-off-by: Martin K. Petersen

treewide: Switch/rename to timer_delete[_sync]()

2025-04-05T08:30:12+00:00

timer_delete[_sync]() replaces del_timer[_sync](). Convert the whole tree over and remove the historical wrapper inlines. Conversion was done with coccinelle plus manual fixups where necessary. Signed-off-by: Thomas Gleixner Signed-off-by: Ingo Molnar

scsi: isci: Make most module parameters static

2025-03-11T01:13:03+00:00

Most of the module parameters are only used locally in the same C file; so static them. Signed-off-by: Dr. David Alan Gilbert Link: https://lore.kernel.org/r/20250309145044.38586-1-linux@treblig.org Reviewed-by: Damien Le Moal Signed-off-by: Martin K. Petersen

scsi: isci: Fix double word in comments

2025-02-03T22:53:52+00:00

Remove the repeated word "for" in comments. Signed-off-by: Charles Han Link: https://lore.kernel.org/r/20250124081330.210724-1-hanchunchao@inspur.com Signed-off-by: Martin K. Petersen

scsi: isci: Remove unused isci_remote_device_reset_complete()

2025-01-02T18:21:55+00:00

isci_remote_device_reset_complete() last use was removed in 2012 by commit 14aaa9f0a318 ("isci: Redesign device suspension, abort, cleanup.") Remove it. It was the last user of sci_remote_device_reset_complete(). Remove it. Signed-off-by: Dr. David Alan Gilbert Link: https://lore.kernel.org/r/20241223180218.50426-1-linux@treblig.org Signed-off-by: Martin K. Petersen