From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f179.google.com (mail-pl1-f179.google.com [209.85.214.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B492936A36B for ; Tue, 7 Jul 2026 15:13:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.179 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783437232; cv=none; b=FUm/VFPrXprUHdK9xFVreaMB5W1V3muKqFo3A6Cx6Wy4KHdvmADkDhw/eA+jKuqhJuvVjD9alGDl0MK2yTrwWhd8uQAeII8pPoknxsQoTLSiir6gRk3x+LlFAtdgv0IXrSe5dDVjn3zDejxFess6z9Z+wGaUABR92UcAWGqLhaE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783437232; c=relaxed/simple; bh=XgaQtR0zEhOxU+LUxU7nc6R+DsNex8WNVCypeAJAl60=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=n8NsWlbDSVhyRNQuvQ22DDHr+vE/v7JPZeZfedlusecGl2kG3+c4wL8dCsp59Pwl1uDOTioKzeWFsuh+Yef2kGr4nH4Yt4rFoNHmNYY6sCbem8GgCJrzSP2iT5cSJBlEZHWBq97qazmhW/VTwBmkzLQNmhQvVTvK97fS8ssvjzw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=V7VMw7td; arc=none smtp.client-ip=209.85.214.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="V7VMw7td" Received: by mail-pl1-f179.google.com with SMTP id d9443c01a7336-2cc8e87f29bso18854815ad.2 for ; Tue, 07 Jul 2026 08:13:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783437231; x=1784042031; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=RdfpnM3CA2QwImWOuD1el08v3VrLUrTzpOPnDM3A8bw=; b=V7VMw7tdJg/FohUA+SF+Es1EGzg5CwaoZizJlMwFmSL/7WCOlsfBYGry4NAN1PAQNS 4HgRV6qnUyUDoyH50o+oLt0NYDn/ahZ2ocZOISvilVNZMnmZ9pmdcR0ZbpbCxVILU/8i o1Vhr5Kb4quxmgha4CkKV39tHX6b+YGOcdBqN7T1qUfa0iy2zKjL8hcZE1bh5Lo3urWu HWvKye1p8YVfmJMPI/Yz4MbgKFlS933eixfMLPrmARKOjdMzkO77hlIswt6+KMkh+x4d iFSC0OEyOZLqJPXu+mXyn5YOc+thD+A6DxV1lkipIYkQRUCHS6MoHdCRNcQkIUBAIn3J 4jTw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783437231; x=1784042031; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=RdfpnM3CA2QwImWOuD1el08v3VrLUrTzpOPnDM3A8bw=; b=sd9aJWEGgSZAKK9q/hhEK7aPXqXM+Om/iId3oJJKtibA9+5qkA5BaTJYbSU5eUmb5g EPZvK2Pt+4hZhUOGGxV//HcgzJ1Qj3VoS0z/3EYAezCPg1Q8oKK3Muf+rTJo2aibB00x 9yqVgFRSdhw3ZxXj3bPlTWb0Jj+Py6nkiUQeTJrcn+Ye8nAKmooh89X3vrmnDQ5DmDbK wnsGhYTZcWFsW6qsn4+b6fEsW/d5m1nRGPGLRlHoCiVwXU6AQV1w/hbXZ/lULAr+qk9D HrQU3przCFQejH//7NuSwZrA2VwqsGKojZxBrri2NdxZeojyx2pnGv7/WCv6bd5LcnSJ xoMA== X-Forwarded-Encrypted: i=1; AHgh+Rr7ubI5bz1hqfZp1tuYEjJLKdwlCdecg07Dhga6go2LxkbD5JtVOjLblIUs/uCOpa4NHOgxl+UMx/Mx4ZE=@vger.kernel.org X-Gm-Message-State: AOJu0Yyi2cONEEUU0KWt97JO00rwT2Em3GazWllA+Dq70jJxBPpvRNOy 3pxvgtHrC7iFejmw3Pr/0PQtgi9R9DTa3v/STQ6qmN7l37VtjrGI25ei X-Gm-Gg: AfdE7clcpIH8GMk7KRmpqzllFCHJeNn2kVcq2uFyBXG+km3NYrpHQVVtNOYuGGBMq3K tjHY8XICk6HAXjVA5HMgHVbwB0wx37vhBMx7Lv8WQsHRgRcit4kg8mlsaDAv8jRXJw7BKLPN1sB stcH0GvC9++9mOxW+wZuSHbjNaUQi2vGT0PF9WL/a6LglV5XV4eRGVYRnefBDPEyG3bz3aYFLAf h/zVPiiSh/93DhfdLCVO5D9MFztS20ZeWobMTN06J4DKanM7yZbYNNOw15sX0WswKCx/TkM4U0J hxckRYFh8oAp5EJFTzH2GOlUypCa35nAfc9ncYeHSIE8B4R3K3i2d0DLzRuMh/5GN/4dQvnl2GM PFx8e3QqHDD/eE4rKE86bgli48Ns2MxdjtW0+GA+w8YlQFDAOK/UTN/KwKLy8xL6i6EgJ2SFu/R ZcLd4ZdiKqE+9LdxprHwzC8VNKc7quG6r4 X-Received: by 2002:a17:903:160c:b0:2ca:c4a5:84bb with SMTP id d9443c01a7336-2ccbf05f204mr60422535ad.38.1783437230010; Tue, 07 Jul 2026 08:13:50 -0700 (PDT) Received: from haichao.tail057a43.ts.net ([2001:da8:e000:1206:239e:a31b:1d0d:374f]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2ccc9bdcbe2sm14127215ad.9.2026.07.07.08.13.46 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 07 Jul 2026 08:13:49 -0700 (PDT) From: Ruoyu Wang To: sathya.prakash@broadcom.com, sreekanth.reddy@broadcom.com, suganath-prabu.subramani@broadcom.com, ranjan.kumar@broadcom.com Cc: James.Bottomley@HansenPartnership.com, MPT-FusionLinux.pdl@broadcom.com, linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org, Ruoyu Wang Subject: [PATCH] scsi: mptfusion: Avoid NULL alt_ioc reload in reset work Date: Tue, 7 Jul 2026 23:13:43 +0800 Message-ID: <20260707151344.2335768-1-ruoyuw560@gmail.com> X-Mailer: git-send-email 2.51.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit mpt_fault_reset_work() alternates delayed fault polling between bound IOC ports by switching to ioc->alt_ioc before rearming the timer. The peer pointer is cleared from detach and probe-error paths without holding the task management lock used when the worker rearms itself. The old code tested ioc->alt_ioc and then loaded it again for assignment. If the peer clear lands between those loads, ioc becomes NULL and the following spin_lock_irqsave(&ioc->taskmgmt_lock, flags) dereferences NULL. Take one READ_ONCE() snapshot and fall back to the current IOC when no alternate is present. This preserves the existing alternating polling behavior while removing the NULL reload window. This issue was found by a static analysis checker and confirmed by manual source review. Fixes: d54d48b80fb5 ("[SCSI] mpt fusion : Adding FAULT Reset polling work") Signed-off-by: Ruoyu Wang --- drivers/message/fusion/mptbase.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/message/fusion/mptbase.c b/drivers/message/fusion/mptbase.c index 3a431ffd3e2eb..29bcf44356d23 100644 --- a/drivers/message/fusion/mptbase.c +++ b/drivers/message/fusion/mptbase.c @@ -424,8 +424,7 @@ mpt_fault_reset_work(struct work_struct *work) /* * Take turns polling alternate controller */ - if (ioc->alt_ioc) - ioc = ioc->alt_ioc; + ioc = READ_ONCE(ioc->alt_ioc) ?: ioc; /* rearm the timer */ spin_lock_irqsave(&ioc->taskmgmt_lock, flags); -- 2.51.0