From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f180.google.com (mail-pl1-f180.google.com [209.85.214.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9851C3195F5 for ; Sun, 25 Jan 2026 12:18:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.180 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769343532; cv=none; b=ipXVG2PFJWWVsSRfmkJbha6Yk6t0i4YJ1Zd3CkD83cuLjGQj4r1+XSNuZKDJ57zaY+73J95p4aJuhRTyH+CnfZ8Yq9fZVkeK5dicM/ezJYz9h9ysKdGXcFLyQ8vsIcPQLxJCxMjR8b8XqDOS/dxwaDdPOontWmmq7ffQg0BPoG0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769343532; c=relaxed/simple; bh=KQP4yBm9Z+zvXXpSXMSUzyw7caH5FYZUnnmnFyBIuYw=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=F7ZXAFNn+tWqInDxtn4S4sY0D2ol5vUxFZuIo33o9AyqDlxuUrQTIUqp+0lbsAyphF0SZhlFaZQJvNetnv2iqZVL6FlonWRpYJjIb+FZB0s22uYqPk9NHkd3zp64jiyJvp3TlCnYXSo0aNilro24+jNOFI0l5i8+LpQZAmBVgWU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=CXKRt7TS; arc=none smtp.client-ip=209.85.214.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="CXKRt7TS" Received: by mail-pl1-f180.google.com with SMTP id d9443c01a7336-29f2676bb21so37714255ad.0 for ; Sun, 25 Jan 2026 04:18:51 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1769343531; x=1769948331; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=oXfRamd6fsg72ILTJTgDUDn0ttsheLvgNZJiy7avqbw=; b=CXKRt7TSFsNMcJLKKsGgYo8Ug4h5yNvaO1sVwSovRPXb0PmmEVUIS4tuT8SNoU7X5R tiriKwecfWz1K2YHqLwO2z84f6Uonb4QjYd6mslg+YhFSpQKVfBKuuL4R88KWrMl1ne1 JWcWaHHA4oi2hXMpWwIxg9gYAdvjbVxcv+czeaKcHZNVILGf9X7OlwSxkg3Z/v0fUXu9 F2VHMJy5MkD8p89kx4f6DQXe+xnTLuqbSvLKButKyccwRZdZBtBUB0u8jjhr2ehVlnt6 yWmni05g0ujlcECyd4fmUWXCatpTM6a6M1MupQutMQh07klwn2WJgPZlYwIwIVRu7mIq U1Hg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1769343531; x=1769948331; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=oXfRamd6fsg72ILTJTgDUDn0ttsheLvgNZJiy7avqbw=; b=rS8Ikwhvbfs43J9Ka4WodCezSbOHGys8nboEG6rGtg0dTgxi9omyb/r2xjU9f6o4T6 IH/W6CKURgkH66uBS6GD9bCaZOV2m10ZoVI2RncZPnnJgdK7MqrrStBbi5cnxSge/UeF fDh+a7I8lRQPiNbX9UcHcN61gOoMvb92CEU58C2utwGOUldJhKOf0HJmrEQfRR00rtEj 5b9xs23MB9wW05y215jiQCLs4hXeQ146MR5tkM41eudj9ll8+HcktUIDpxC6iEoXbIhm 8drRHjIqr4ohOokxnAgpNyIpib/L0dUoqglhr1RnWeE3yv+5sTNj5ZJM1cnHrqAcxboV D/fQ== X-Forwarded-Encrypted: i=1; AJvYcCVmY6QExn/anG4h+3+QZjwy5GYISFK8qkH+Z2v0Eagh1eCoF2RIfd4jf7wzHCusAJ5RoGp4HFmw7V7xais=@vger.kernel.org X-Gm-Message-State: AOJu0Yw6ZujMCrEKEfDKXfipKocI6g3JBXC+eN65dfZ+Ao/keAFVqFgr 44/zpLvlKz4Kc/VdnakYsbdB69Sf+bRl5KO+CFfBMC8y4u+pxv6aq+7v X-Gm-Gg: AZuq6aIiFD+YJ5U/gGXStgapZXLUCG4JwpCL8LA1c+1OOVCHlIVORUO8qunGJWk7IPm 2CiHsvewKp4aPdvFBsX3JLepyfgaKLvvVtC5RkfeGDkMW4xhw4ZY/6kz+Un0QktLeGka12CpUcM zbi+yGDP9na/VQ6QPrXqOG/ozavrUseBm5LHSWgd+pTztfOOydQ3VIb4VlCHUkB7N7xY54avqRc LtgF/PFkNQdwwUXyAQr3ujfV8IlIboOP7tFs9IEAiHM/Ar09bh0QIFXkJxFDvRQfDt5b446iJe4 t/Ocv9V/nvKxLzz1xaU4vxkxYj2xG9PxL8RBx4eI2n+vrxZ1epdPoXj2sDtVDLdnmbRVYpEatpg OykbTeLii8Oipq2rXfJIYS/bjdphRpE08U88AAnHPZ3y4ZsLs7E1ojbBUvLxAWPOhAXu/PYsFZl DdzBrdvYwdvgY6BJ2dls+qy6S82CKZtJBiTpD/pnGp X-Received: by 2002:a17:903:fab:b0:297:e3c4:b2b0 with SMTP id d9443c01a7336-2a8453409a1mr10777035ad.54.1769343530990; Sun, 25 Jan 2026 04:18:50 -0800 (PST) Received: from localhost.localdomain ([113.218.252.97]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2a802f974d8sm66774625ad.63.2026.01.25.04.18.47 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Sun, 25 Jan 2026 04:18:50 -0800 (PST) From: chengkaitao To: kashyap.desai@broadcom.com, sumit.saxena@broadcom.com, shivasharan.srikanteshwara@broadcom.com, chandrakanth.patil@broadcom.com, James.Bottomley@HansenPartnership.com, martin.petersen@oracle.com Cc: megaraidlinux.pdl@broadcom.com, linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org, Chengkaitao Subject: [RFC 0/2] megaraid: fix illegal pointer dereference in complete_cmd_fusion Date: Sun, 25 Jan 2026 20:18:40 +0800 Message-ID: <20260125121842.79839-1-pilgrimtao@gmail.com> X-Mailer: git-send-email 2.50.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Chengkaitao We have encountered several instances of null pointer dereferences in the complete_cmd_fusion function. The root cause was consistently the reply_desc->SMID being erroneously set to 0xffff, resulting in an invalid cmd_fusion pointer retrieval. After code review, I suspect synchronization issues in complete_cmd- _fusion. However, due to the low reproducibility rate of this problem, I could not perform effective validation. I propose the patch for kernel community discussion to explore better solutions. Chengkaitao (2): megaraid: Fix the issue of erroneous reset of Words in reply_desc megaraid: replacing fusion->busy_mq_poll[*] with irq_context->in_used in megasas_blk_mq_poll drivers/scsi/megaraid/megaraid_sas_fusion.c | 18 ++++++++++-------- drivers/scsi/megaraid/megaraid_sas_fusion.h | 2 -- 2 files changed, 10 insertions(+), 10 deletions(-) -- 2.50.1 (Apple Git-155)