Re: [PATCH] scsi: dc395x: sync the waiting_timer before freeing the host

[Oliver Neukum]

On 10.08.26 07:50, Fan Wu wrote:
> The waiting_timer callback re-arms itself and takes the host lock.
> adapter_uninit() currently stops it with timer_delete(), which does not
> wait for a callback already running on another CPU. The final
> scsi_host_put() that frees the host (and the host lock the callback
> dereferences) runs right after adapter_uninit(), so a concurrent or just
> re-armed callback can fire after the free, leaving a potential
> use-after-free window.
>
> Replace timer_delete() with timer_shutdown_sync() and move it after
> free_irq(), outside the host-lock section. This waits for a running
> callback and prevents it from re-arming, while avoiding the self-deadlock
> that would result from syncing a callback blocked on the lock we still
> hold.

Thank you for the patch. It raises a question, though. Do you want
the timers to fire after the adapter has already ceased to function?

	Regards
		Oliver