scsi: leapraid: Balance host references for firmware log VMAs

leapraid_fw_mmap() keeps the Scsi_Host reference obtained while looking up
the adapter for the lifetime of the initial VMA.  The VMA close callback
drops that reference.

The open callback is also invoked when a VMA is duplicated or split, but it
only increments mmap_refcnt.  Since every corresponding close callback
drops a host reference, cloning the mapping can release the host while
another VMA still refers to the adapter.

Take a host device reference for every VMA open and release the lookup
reference once the initial mapping has acquired its own reference.  Use
get_device() because a VMA can be cloned after the host enters SHOST_DEL;
an existing VMA still pins the host at that point and open cannot fail.

Fixes: 5597088c9e ("scsi: leapraid: Add new SCSI driver")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Reviewed-by: Dongdong Hao <doubled@leap-io-kernel.com>
Link: https://patch.msgid.link/20260814033845.2971706-2-lilinmao@kylinos.cn
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
This commit is contained in:
Linmao Li
2026-08-14 11:38:44 +08:00
committed by Martin K. Petersen (Oracle)
parent 0ec418204f
commit 970f69b6bf

View File

@@ -697,6 +697,7 @@ static void leapraid_fw_mmap_open(struct vm_area_struct *vma)
if (!adapter)
return;
get_device(&adapter->shost->shost_gendev);
atomic_inc(&adapter->fw_log_desc.mmap_refcnt);
}
@@ -767,7 +768,6 @@ static int leapraid_fw_mmap(struct file *filp, struct vm_area_struct *vma)
vma->vm_private_data = adapter;
vma->vm_ops = &leapraid_fw_mmap_vm_ops;
leapraid_fw_mmap_open(vma);
adapter = NULL;
rc = 0;
out_put: