Re: [PATCH] scsi: libsas: Fix dev_list race conditions with proper locking

[Damien Le Moal]

On 1/31/26 19:47, Chaohai Chen wrote:
> On Fri, Jan 30, 2026 at 04:27:11PM +0800, Jason Yan wrote:
>> Hi,
>>
>> 在 2026/1/29 17:38, Chaohai Chen 写道:
>>> Multiple functions in libsas were accessing port->dev_list without
>>> proper locking, leading to potential race conditions that could cause:
>>> - Use-after-free when devices are removed during list traversal
>>> - List corruption from concurrent modifications
>>> - System crashes from accessing freed memory
>>
>> libsas events are processed in orderd workqueue. Do you have a crash log?
> No crash log. I noticed the missing locks while watching the code. But
> there are tow queues, event_q and disco_q which may cause conflicts.
> And I think the dev_ist_lock is designed to prevent conflicts.

I am not so sure this is true in general. E.g. when sas_suspend_devices() is
called form a disco_q work context, events are disabled, so there cannot be
changes to a port dev_list.

If you have no crash log, please provide a more detailed analysis of the
potential problems. Given that no one has reported an issue in this area (that I
know of), if there is a problem, it is definitely not obvious and thus requires
detailed explanation to be understood.

-- 
Damien Le Moal
Western Digital Research