Re: [PATCH v3] scsi: pm8001: Fix use-after-free in pm8001_queue_command()

[Martin K. Petersen]

On Fri, 13 Feb 2026 19:28:06 +0000, Salomon Dushimirimana wrote:

> Commit e29c47fe8946 ("scsi: pm8001: Simplify pm8001_task_exec()")
> refactors pm8001_queue_command(), however it introduces a potential
> cause of a double free scenario when it changes the function to return
> -ENODEV in case of phy down/device gone state.
> 
> In this path, pm8001_queue_command updates task status and calls
> task_done to indicate to upper layer that the task has been handled.
> However, this also frees the underlying sas task. A -ENODEV is then
> returned to the caller. When libsas sas_ata_qc_issue receives this error
> value, it assumes the task wasn't handled/queued by LLDD and proceeds to
> clean up and free the task again, resulting in a double free.
> 
> [...]

Applied to 7.0/scsi-fixes, thanks!

[1/1] scsi: pm8001: Fix use-after-free in pm8001_queue_command()
      https://git.kernel.org/mkp/scsi/c/38353c26db28

-- 
Martin K. Petersen