diff options
| author | Chandrakanth Patil <chandrakanth.patil@broadcom.com> | 2026-08-26 02:34:10 +0530 |
|---|---|---|
| committer | Martin K. Petersen (Oracle) <mkp@kernel.org> | 2026-09-09 22:08:16 -0400 |
| commit | c94c746e6c80439a4a9a0e1e20f2dae62a4d57ef (patch) | |
| tree | 5c193f12f09de6b3415f3582a0a205fcbb36d64a /tools/perf/scripts/python | |
| parent | 052aea807cfbcefaf5b6ed8202f65da1fc65f4a0 (diff) | |
| download | linux-next-c94c746e6c80439a4a9a0e1e20f2dae62a4d57ef.tar.gz linux-next-c94c746e6c80439a4a9a0e1e20f2dae62a4d57ef.zip | |
scsi: mpi3mr: Fix use-after-free of the firmware event workqueue
The enqueue path reads the workqueue pointer before taking the event lock,
while the remove path clears that pointer and destroys the workqueue while
holding it. The enqueue can therefore reach queue_work() after the
workqueue is gone.
Move the check inside the lock.
Fixes: 13ef29ea4aa0 ("scsi: mpi3mr: Add support for device add/remove event handling")
Signed-off-by: Chandrakanth Patil <chandrakanth.patil@broadcom.com>
Link: https://patch.msgid.link/20260825210411.301535-17-chandrakanth.patil@broadcom.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Diffstat (limited to 'tools/perf/scripts/python')
0 files changed, 0 insertions, 0 deletions