Re: [PATCH] scsi: pmcraid: shut down command timers before reuse

[Greg KH]

On Fri, Aug 21, 2026 at 02:23:51PM +0800, Runyu Xiao wrote:
> pmcraid removes a command from the pending pool and then either
> completes it or reuses it for reset. timer_delete() only removes a
> pending timer; it does not wait for a callback already running and does
> not prevent the callback from rearming the timer. A timeout callback can
> therefore access a command block after it has been returned or
> reinitialized.
> 
> The response paths run in hardirq or softirq context, so they cannot
> wait synchronously for a normal timer callback. Shut down the timer there
> and defer completion to a work item. The worker uses
> timer_shutdown_sync() before calling the original completion function.
> The reset cleanup path also defers the reset command when it is still
> pending so the reset engine cannot reinitialize it before its timer
> callback has finished.
> 
> Flush command work before releasing command and control buffers.

How was this found and tested?

> 
> Fixes: 89a3681041507773 ("[SCSI] pmcraid: PMC-Sierra MaxRAID driver to support 6Gb/s SAS RAID controller")
> 
> Cc: stable@xxxxxxxxxxxxxxx
> 
> Signed-off-by: Runyu Xiao <runyu.xiao@xxxxxxxxxx>

Why the extra whitespace?  Didn't checkpatch complain about this?


> 
> diff --git a/drivers/scsi/pmcraid.c b/drivers/scsi/pmcraid.c
> index 942a99393204..ed2ebe68c816 100644
> --- a/drivers/scsi/pmcraid.c
> +++ b/drivers/scsi/pmcraid.c
> @@ -55,6 +55,43 @@ static unsigned int pmcraid_enable_msix;
>   */
>  static atomic_t pmcraid_adapter_count = ATOMIC_INIT(0);
>  
> +static void pmcraid_cmd_work(struct work_struct *work);
> +static void pmcraid_complete_reset_cmd(struct pmcraid_cmd *cmd);
> +
> +static void pmcraid_complete_reset_cmd(struct pmcraid_cmd *cmd)

Why the prototype right before the definition?  Did a LLM create this
patch?  If so, you should upgrade to a better coding model :)

thanks,

greg k-h