linux-kernel - [RFC 1/2] megaraid: Fix the issue of erroneous reset of Words in reply

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20260125121842.79839-2-pilgrimtao@gmail.com>
Date: Sun, 25 Jan 2026 20:18:41 +0800
From: chengkaitao <pilgrimtao@...il.com>
To: kashyap.desai@...adcom.com,
	sumit.saxena@...adcom.com,
	shivasharan.srikanteshwara@...adcom.com,
	chandrakanth.patil@...adcom.com,
	James.Bottomley@...senPartnership.com,
	martin.petersen@...cle.com
Cc: megaraidlinux.pdl@...adcom.com,
	linux-scsi@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Chengkaitao <chengkaitao@...inos.cn>
Subject: [RFC 1/2] megaraid: Fix the issue of erroneous reset of Words in reply_desc

From: Chengkaitao <chengkaitao@...inos.cn>

The following panic occurred on kernel 6.6 (arch: loongarch):
Call Trace:
complete_cmd_fusion+0x180/0x7c8 [megaraid_sas]
megasas_isr_fusion+0xd4/0xf0 [megaraid_sas]
__handle_irq_event_percpu+0x70/0x228
handle_irq_event+0x44/0xf8
handle_edge_irq+0xe8/0x328
avecintc_irq_dispatch+0x68/0x120
handle_irq_desc+0x5c/0x78
handle_cpu_irq+0x6c/0xa8
handle_loongarch_irq+0x2c/0x48
do_vint+0x7c/0xd0
sched_update_worker+0x8/0x90
worker_thread+0x218/0x480
kthread+0xf0/0xf8
ret_from_kernel_thread+0x28/0xc8
ret_from_kernel_thread_asm+0xc/0xa0

Observed symptoms during the issue:
complete_cmd_fusion(struct megasas_instance *instance, u32 MSIxIndex,
		    struct megasas_irq_context *irq_context)
{
	******

	while (d_val.u.low != cpu_to_le32(UINT_MAX) &&
	       d_val.u.high != cpu_to_le32(UINT_MAX)) {

	/**
		When the issue occurs:
		d_val.u.low == 60293120
		d_val.u.high == 0
		reply_desc->SMID == 0xffff
 	 **/
		smid = le16_to_cpu(reply_desc->SMID);
		cmd_fusion = fusion->cmd_list[smid - 1];
		scsi_io_req = (struct MPI2_RAID_SCSI_IO_REQUEST *)
						cmd_fusion->io_request;
	/** cmd_fusion becomes an invalid pointer **/

	******
}

In the complete_cmd_fusion function, the following assignment exists:
	d_val.word = desc->Words;
Thus, reply_desc->SMID == 0xffff may be caused by a concurrency-related
corruption.

Reproduction probability is very low. After code review, I suspect the
following race condition scenario:

interrupt(complete_cmd_fusion)           cpu1(megasas_reset_reply_desc)
while (d_val.u.low != *****) {
        scsi_io_req =
            cmd_fusion->io_request;

        d_val.word = desc->Words;
                                        reply_desc->Words =
                                          cpu_to_le64(ULLONG_MAX);
}

Note: This is a proposed patch for discussion only. It has not been
verified to resolve the issue. If you have alternative suggestions,
please join the discussion.

Signed-off-by: Chengkaitao <chengkaitao@...inos.cn>
---
 drivers/scsi/megaraid/megaraid_sas_fusion.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c
index a6794f49e9fa..3d3480b19734 100644
--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
+++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
@@ -4282,16 +4282,23 @@ void  megasas_reset_reply_desc(struct megasas_instance *instance)
 	int i, j, count;
 	struct fusion_context *fusion;
 	union MPI2_REPLY_DESCRIPTORS_UNION *reply_desc;
+	struct megasas_irq_context *irq_context;
 
 	fusion = instance->ctrl_context;
 	count = instance->msix_vectors > 0 ? instance->msix_vectors : 1;
 	count += instance->iopoll_q_count;
 
 	for (i = 0 ; i < count ; i++) {
+		irq_context = &instance->irq_context[i];
+		while (!access_irq_context(irq_context))
+			cpu_relax();
+
 		fusion->last_reply_idx[i] = 0;
 		reply_desc = fusion->reply_frames_desc[i];
 		for (j = 0 ; j < fusion->reply_q_depth; j++, reply_desc++)
 			reply_desc->Words = cpu_to_le64(ULLONG_MAX);
+
+		release_irq_context(irq_context);
 	}
 }
 
-- 
2.50.1 (Apple Git-155)