scsi: mpi3mr: Fix firmware event reference leak during cleanup

During firmware event cleanup, when an event is currently executing or
pending at the SCSI mid-layer, the driver sets a discard flag and exits the
cleanup routine early. This early exit skips the normal cancel path,
resulting in the firmware event reference count not being decremented,
leading to a reference leak.

Additionally, resolve the following concurrency issues in the firmware
event handling paths:

 1. mpi3mr_cleanup_fwevt_list() read current_event locklessly. It is now
    acquired under fwevt_lock.

 2. mpi3mr_dequeue_fwevt() dropped the reference before returning it,
    risking a use-after-free. The drop is now moved into
    mpi3mr_cancel_work().

 3. mpi3mr_fwevt_bh() dropped fwevt_lock mid-move, racing with unload.  The
    move is now inlined under one continuous lock hold.

 4. pending_at_sml was read/written without a lock, risking an ABBA
    deadlock. It is now protected by fwevt_lock throughout.

 5. mpi3mr_suspend() could unmap PCI resources before the event worker
    finished. It now flushes the workqueue first.

 6. mpi3mr_report_tgtdev_to_host() and mpi3mr_remove_tgtdev_from_host()
    could still set pending_at_sml and block in the SCSI mid-layer after a
    stop or reset had already begun, deadlocking against the thread waiting
    on that flag. Both now bail out beforehand once stop_drv_processing or
    reset_in_progress is set.

Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260626114109.43685-1-ranjan.kumar@broadcom.com?part=7
Closes: https://sashiko.dev/#/patchset/20260708183305.244485-1-ranjan.kumar@broadcom.com?part=7
Closes: https://sashiko.dev/#/patchset/20260724102505.115136-1-ranjan.kumar@broadcom.com?part=7
Co-developed-by: Chandrakanth Patil <chandrakanth.patil@broadcom.com>
Signed-off-by: Chandrakanth Patil <chandrakanth.patil@broadcom.com>
Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com>
Link: https://patch.msgid.link/20260916082705.44712-8-ranjan.kumar@broadcom.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>

0 files changed, 0 insertions, 0 deletions