leapraid_fw_log_exit() waits for mmap_refcnt to reach zero before it frees
the firmware log buffer. leapraid_fw_mmap() checks host_removing, but it
does not increment mmap_refcnt until after dma_mmap_coherent() succeeds and
the VMA open callback runs.
Removal can set host_removing and observe a zero mmap_refcnt between the
check and the VMA open. It can then free the coherent buffer while the
mmap path is still establishing a userspace mapping of it.
Claim a temporary mmap reference while looking up the adapter under
leapraid_adapter_lock. Removal deletes the adapter from the same locked
list after setting host_removing, so a mapping is either rejected or
included in the count that removal waits for. Drop the temporary reference
on the common exit path, after a successful VMA open has acquired the
reference covering the VMA lifetime.
Fixes: 5597088c9e ("scsi: leapraid: Add new SCSI driver")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Reviewed-by: Dongdong Hao <doubled@leap-io-kernel.com>
Link: https://patch.msgid.link/20260814033845.2971706-3-lilinmao@kylinos.cn
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
leapraid_fw_mmap() keeps the Scsi_Host reference obtained while looking up
the adapter for the lifetime of the initial VMA. The VMA close callback
drops that reference.
The open callback is also invoked when a VMA is duplicated or split, but it
only increments mmap_refcnt. Since every corresponding close callback
drops a host reference, cloning the mapping can release the host while
another VMA still refers to the adapter.
Take a host device reference for every VMA open and release the lookup
reference once the initial mapping has acquired its own reference. Use
get_device() because a VMA can be cloned after the host enters SHOST_DEL;
an existing VMA still pins the host at that point and open cannot fail.
Fixes: 5597088c9e ("scsi: leapraid: Add new SCSI driver")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Reviewed-by: Dongdong Hao <doubled@leap-io-kernel.com>
Link: https://patch.msgid.link/20260814033845.2971706-2-lilinmao@kylinos.cn
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
The LeapRAID driver provides support for LeapRAID PCIe RAID controllers,
enabling communication between the host operating system, firmware, and
hardware for efficient storage management.
The driver is organized into several logical modules, each with a clear
responsibility:
leapraid_os.c: Integrates with the Linux SCSI subsystem, handling host
template callbacks, PCIe device probing, and initialization.
leapraid_func.c: Contains low-level routines for firmware/hardware
interaction, interrupt handling, and reset logic.
leapraid_app.c: Provides the ioctl interface for user-space tools.
leapraid_transport.c: Manages interactions with the SCSI transport
layer for SAS PHYs and ports.
leapraid_func.h: Contains internal definitions shared among driver
modules.
leapraid.h: Contains low-level hardware definitions for
driver/firmware interaction.
The leapraid_probe() function orchestrates the setup: it allocates the
adapter structure and SCSI host, configures hardware interfaces, and
registers it with the SCSI mid-layer. Following registration,
scsi_scan_host() is invoked to initiate device discovery, with firmware
reporting devices via interrupt-driven events.
This initial commit provides the necessary infrastructure for
subsequent development of full I/O path handling, error recovery,
and advanced management features.
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Hannes Reinecke <hare@kernel.org>
Signed-off-by: Dongdong Hao <doubled@leap-io-kernel.com>
Link: https://patch.msgid.link/0cbc6245aabdc6e8c90587675e76ba316c5b549e.1785823793.git.doubled@leap-io-kernel.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
