[PATCH] scsi: aic94xx: Free the IRQ before killing the completion tasklet

[Myeonghun Pak]

Masking the adapter interrupt does not wait for an interrupt handler
that is already running. Such a handler can schedule dl_tasklet after
tasklet_kill() returns in asd_pci_remove(), leaving the tasklet pending
when the adapter state and done list are freed.

Move free_irq() ahead of tasklet_kill() so the last possible producer is
joined first. Apply the same ordering to probe failures after interrupts
have been enabled; those paths currently never drain dl_tasklet.

This completes the removal ordering added by commit f6ab594672d4 ("scsi:
aic94xx: fix use-after-free in device removal path").

This issue was found by static analysis.

Fixes: 2908d778ab3e ("[SCSI] aic94xx: new driver")
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@xxxxxxxxx>
Signed-off-by: Ijae Kim <ae878000@xxxxxxxxx>
Signed-off-by: Myeonghun Pak <mhun512@xxxxxxxxx>
---
Compile-tested with GCC, W=1 (arm). No runtime testing.

 drivers/scsi/aic94xx/aic94xx_init.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/aic94xx/aic94xx_init.c b/drivers/scsi/aic94xx/aic94xx_init.c
index 4400a36..89e584c 100644
--- a/drivers/scsi/aic94xx/aic94xx_init.c
+++ b/drivers/scsi/aic94xx/aic94xx_init.c
@@ -810,6 +810,7 @@ static int asd_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
 Err_escbs:
 	asd_disable_ints(asd_ha);
 	free_irq(dev->irq, asd_ha);
+	tasklet_kill(&asd_ha->seq.dl_tasklet);
 Err_irq:
 	if (use_msi)
 		pci_disable_msi(dev);
@@ -881,6 +882,7 @@ static void asd_pci_remove(struct pci_dev *dev)
 	asd_unregister_sas_ha(asd_ha);
 
 	asd_disable_ints(asd_ha);
+	free_irq(dev->irq, asd_ha);
 
 	/* Ensure all scheduled tasklets complete before freeing resources */
 	tasklet_kill(&asd_ha->seq.dl_tasklet);
@@ -889,7 +891,6 @@ static void asd_pci_remove(struct pci_dev *dev)
 
 	/* XXX more here as needed */
 
-	free_irq(dev->irq, asd_ha);
 	if (use_msi)
 		pci_disable_msi(asd_ha->pcidev);
 	asd_turn_off_leds(asd_ha);