scsi: leapraid: Serialize firmware log mmap with teardown

leapraid_fw_log_exit() waits for mmap_refcnt to reach zero before it frees
the firmware log buffer.  leapraid_fw_mmap() checks host_removing, but it
does not increment mmap_refcnt until after dma_mmap_coherent() succeeds and
the VMA open callback runs.

Removal can set host_removing and observe a zero mmap_refcnt between the
check and the VMA open.  It can then free the coherent buffer while the
mmap path is still establishing a userspace mapping of it.

Claim a temporary mmap reference while looking up the adapter under
leapraid_adapter_lock.  Removal deletes the adapter from the same locked
list after setting host_removing, so a mapping is either rejected or
included in the count that removal waits for.  Drop the temporary reference
on the common exit path, after a successful VMA open has acquired the
reference covering the VMA lifetime.

Fixes: 5597088c9e79 ("scsi: leapraid: Add new SCSI driver")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Reviewed-by: Dongdong Hao <doubled@leap-io-kernel.com>
Link: https://patch.msgid.link/20260814033845.2971706-3-lilinmao@kylinos.cn
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>

0 files changed, 0 insertions, 0 deletions