[PATCH] scsi: elx: efct: Use timer_shutdown_sync() for the stats timer

The statistics timer re-arms itself on every expiry through
efct_xport_config_stats_timer().  timer_delete() only detaches a pending
timer: it does not wait for a callback that is already running and does
not stop that callback from re-arming the timer.  In efct_xport_detach()
the timer is stopped before efct_xport_free() frees the xport,
so a callback that re-armed it can fire after the free and dereference the
freed object.  efct_fw_reset() stops the same timer before a hardware
reset, where a callback left running can race the reset and re-arm the
timer.

timer_shutdown_sync() waits for a running callback to finish and
guarantees that the timer cannot be rearmed once it returns, so use it at
both points.  The now-pointless timer_pending() checks are dropped.

This issue was found by an in-house static analysis tool.

Fixes: ab332fcbcd81 ("scsi: elx: efct: Transport and hardware teardown routines")
Cc: [email protected] # v6.2+
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <[email protected]>
---
 drivers/scsi/elx/efct/efct_driver.c | 3 +--
 drivers/scsi/elx/efct/efct_xport.c  | 3 +--
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/scsi/elx/efct/efct_driver.c b/drivers/scsi/elx/efct/efct_driver.c
index 07c2f4534..3556c6d8a 100644
--- a/drivers/scsi/elx/efct/efct_driver.c
+++ b/drivers/scsi/elx/efct/efct_driver.c
@@ -309,8 +309,7 @@ efct_fw_reset(struct efct *efct)
 	 * Function 0 will update and load the new firmware
 	 * during attach.
 	 */
-	if (timer_pending(&efct->xport->stats_timer))
-		timer_delete(&efct->xport->stats_timer);
+	timer_shutdown_sync(&efct->xport->stats_timer);
 
 	if (efct_hw_reset(&efct->hw, EFCT_HW_RESET_FIRMWARE)) {
 		efc_log_info(efct, "failed to reset firmware\n");
diff --git a/drivers/scsi/elx/efct/efct_xport.c b/drivers/scsi/elx/efct/efct_xport.c
index 9dcaef6fc..84fa5589e 100644
--- a/drivers/scsi/elx/efct/efct_xport.c
+++ b/drivers/scsi/elx/efct/efct_xport.c
@@ -507,8 +507,7 @@ efct_xport_detach(struct efct_xport *xport)
 	efct_scsi_del_device(efct);
 
 	/*Shutdown FC Statistics timer*/
-	if (timer_pending(&xport->stats_timer))
-		timer_delete(&xport->stats_timer);
+	timer_shutdown_sync(&xport->stats_timer);
 
 	efct_hw_teardown(&efct->hw);
 
-- 
2.34.1