scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod

Since commit f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when
device is gone") UBSAN reports:

  UBSAN: array-index-out-of-bounds in drivers/scsi/pm8001/pm8001_sas.c:786:17
  index 28 is out of range for type 'pm8001_phy [16]'

on rmmod when using an expander.

For a direct attached device, attached_phy contains the local phy id.
For a device behind an expander, attached_phy contains the remote phy
id, not the local phy id.

I.e. while pm8001_ha will have pm8001_ha->chip->n_phy local phys, for a
device behind an expander, attached_phy can be much larger than
pm8001_ha->chip->n_phy (depending on the amount of phys of the
expander).

E.g. on my system pm8001_ha has 8 phys with phy ids 0-7.  One of the
ports has an expander connected.  The expander has 31 phys with phy ids
0-30.

The pm8001_ha->phy array only contains the phys of the HBA.  It does not
contain the phys of the expander.  Thus, it is wrong to use attached_phy
to index the pm8001_ha->phy array for a device behind an expander.

Thus, we can only clear phy_attached for devices that are directly
attached.

Fixes: f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when device is gone")
Reviewed-by: Igor Pylypiv <ipylypiv@google.com>
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Link: https://lore.kernel.org/r/20250814173215.1765055-14-cassel@kernel.org
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Tested-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
index 753c09363cbbcb5887bdc7d383f59e8220665831..3e1dac4b820feaad4a6ada4184ce7ab460dedc79 100644 (file)
--- a/drivers/scsi/pm8001/pm8001_sas.c
+++ b/drivers/scsi/pm8001/pm8001_sas.c
@@ -749,6 +749,7 @@ static void pm8001_dev_gone_notify(struct domain_device *dev)
        unsigned long flags = 0;
        struct pm8001_hba_info *pm8001_ha;
        struct pm8001_device *pm8001_dev = dev->lldd_dev;
+       struct domain_device *parent_dev = dev->parent;
 
        pm8001_ha = pm8001_find_ha_by_dev(dev);
        spin_lock_irqsave(&pm8001_ha->lock, flags);
@@ -765,7 +766,13 @@ static void pm8001_dev_gone_notify(struct domain_device *dev)
                        spin_lock_irqsave(&pm8001_ha->lock, flags);
                }
                PM8001_CHIP_DISP->dereg_dev_req(pm8001_ha, device_id);
-               pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0;
+
+               /*
+                * The phy array only contains local phys. Thus, we cannot clear
+                * phy_attached for a device behind an expander.
+                */
+               if (!(parent_dev && dev_is_expander(parent_dev->dev_type)))
+                       pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0;
                pm8001_free_dev(pm8001_dev);
        } else {
                pm8001_dbg(pm8001_ha, DISC, "Found dev has gone.\n");