[PATCH v2] scsi: libsas: Fix use-after-free in sas_eh_handle_resets()

[Wentao Liang]

sas_eh_handle_resets() drops the reference it took on the domain device
with sas_put_device() and then accesses dev->state again while holding
ha->lock. The put may release the last reference, so the clear_bit()
can touch freed memory.

Clear the pending flag before dropping the reference.

The candidate was found with static analysis tools; DeepSeek and GPT-6.1
Sol were used to audit it and to help prepare this fix.

Fixes: 5db45bdc87ce ("[SCSI] libsas: enforce eh strategy handlers only in eh context")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
Changes in v2:
- Adopt John's suggestion: clear SAS_DEV_EH_PENDING before
  sas_put_device(), so the locked section is back to just ha->eh_active--.
  Sorry for the late reply.
- Rebuilt on v7.4-rc1 with W=1; drivers/scsi/libsas/ builds cleanly.
- Link to v1: https://lore.kernel.org/all/20260917143946.2157366-1-vulab@xxxxxxxxxxx/

 drivers/scsi/libsas/sas_scsi_host.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/libsas/sas_scsi_host.c b/drivers/scsi/libsas/sas_scsi_host.c
index 76517c8f0684..448f35de67fb 100644
--- a/drivers/scsi/libsas/sas_scsi_host.c
+++ b/drivers/scsi/libsas/sas_scsi_host.c
@@ -695,9 +695,9 @@ static void sas_eh_handle_resets(struct Scsi_Host *shost)
 		if (test_and_clear_bit(SAS_DEV_RESET, &dev->state))
 			i->dft->lldd_I_T_nexus_reset(dev);
 
+		clear_bit(SAS_DEV_EH_PENDING, &dev->state);
 		sas_put_device(dev);
 		spin_lock_irq(&ha->lock);
-		clear_bit(SAS_DEV_EH_PENDING, &dev->state);
 		ha->eh_active--;
 	}
 	spin_unlock_irq(&ha->lock);