scsi: smartpqi: Fix device resources accessed after device removal

JIRA: https://issues.redhat.com/browse/RHEL-107917

commit b518e86
Author: Mike McGowen <mike.mcgowen@microchip.com>
Date:   Thu Nov 6 10:38:20 2025 -0600

    scsi: smartpqi: Fix device resources accessed after device removal

    Correct possible race conditions during device removal.

    Previously, a scheduled work item to reset a LUN could still execute
    after the device was removed, leading to use-after-free and other
    resource access issues.

    This race condition occurs because the abort handler may schedule a LUN
    reset concurrently with device removal via sdev_destroy(), leading to
    use-after-free and improper access to freed resources.

      - Check in the device reset handler if the device is still present in
        the controller's SCSI device list before running; if not, the reset
        is skipped.

      - Cancel any pending TMF work that has not started in sdev_destroy().

      - Ensure device freeing in sdev_destroy() is done while holding the
        LUN reset mutex to avoid races with ongoing resets.

    Fixes: 2d80f40 ("scsi: smartpqi: Update deleting a LUN via sysfs")
    Reviewed-by: Scott Teel <scott.teel@microchip.com>
    Reviewed-by: Scott Benesh <scott.benesh@microchip.com>
    Signed-off-by: Mike McGowen <mike.mcgowen@microchip.com>
    Signed-off-by: Don Brace <don.brace@microchip.com>
    Link: https://patch.msgid.link/20251106163823.786828-3-don.brace@microchip.com
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

(cherry picked from commit b518e86)
Assisted-by: Patchpal
Signed-off-by: Don Brace <dbrace@redhat.com>

Author: donbrace

drivers/scsi/smartpqi/smartpqi_init.c

@@ -6426,10 +6426,22 @@ static int pqi_device_reset(struct pqi_ctrl_info *ctrl_info, struct pqi_scsi_dev
 
 static int pqi_device_reset_handler(struct pqi_ctrl_info *ctrl_info, struct pqi_scsi_dev *device, u8 lun, struct scsi_cmnd *scmd, u8 scsi_opcode)
 {
+	unsigned long flags;
 	int rc;
 
 	mutex_lock(&ctrl_info->lun_reset_mutex);
 
+	spin_lock_irqsave(&ctrl_info->scsi_device_list_lock, flags);
+	if (pqi_find_scsi_dev(ctrl_info, device->bus, device->target, device->lun) == NULL) {
+		dev_warn(&ctrl_info->pci_dev->dev,
+			"skipping reset of scsi %d:%d:%d:%u, device has been removed\n",
+			ctrl_info->scsi_host->host_no, device->bus, device->target, device->lun);
+		spin_unlock_irqrestore(&ctrl_info->scsi_device_list_lock, flags);
+		mutex_unlock(&ctrl_info->lun_reset_mutex);
+		return 0;
+	}
+	spin_unlock_irqrestore(&ctrl_info->scsi_device_list_lock, flags);
+
 	dev_err(&ctrl_info->pci_dev->dev,
 		"resetting scsi %d:%d:%d:%u SCSI cmd at %p due to cmd opcode 0x%02x\n",
 		ctrl_info->scsi_host->host_no, device->bus, device->target, lun, scmd, scsi_opcode);
@@ -6609,7 +6621,9 @@ static void pqi_slave_destroy(struct scsi_device *sdev)
 {
 	struct pqi_ctrl_info *ctrl_info;
 	struct pqi_scsi_dev *device;
+	struct pqi_tmf_work *tmf_work;
 	int mutex_acquired;
+	unsigned int lun;
 	unsigned long flags;
 
 	ctrl_info = shost_to_hba(sdev->host);
@@ -6636,8 +6650,13 @@ static void pqi_slave_destroy(struct scsi_device *sdev)
 
 	mutex_unlock(&ctrl_info->scan_mutex);
 
+	for (lun = 0, tmf_work = device->tmf_work; lun < PQI_MAX_LUNS_PER_DEVICE; lun++, tmf_work++)
+		cancel_work_sync(&tmf_work->work_struct);
+
+	mutex_lock(&ctrl_info->lun_reset_mutex);
 	pqi_dev_info(ctrl_info, "removed", device);
 	pqi_free_device(device);
+	mutex_unlock(&ctrl_info->lun_reset_mutex);
 }
 
 static int pqi_getpciinfo_ioctl(struct pqi_ctrl_info *ctrl_info, void __user *arg)