[PATCH 17/17] mpi3mr: Fix NULL pointer dereference on PCI error recovery

On a frozen PCI channel the driver unmaps the register window and frees
the interrupts, but leaves the firmware event workqueue running. An
event handler that is already in flight can still reach the register
window after it has been unmapped.

Stop event processing and drain the queue first, and start it again
when the channel resumes.

Fixes: 30bafe1774f0 ("scsi: mpi3mr: Support PCI Error Recovery callback handlers")
Signed-off-by: Chandrakanth Patil <[email protected]>
---
 drivers/scsi/mpi3mr/mpi3mr_os.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/scsi/mpi3mr/mpi3mr_os.c b/drivers/scsi/mpi3mr/mpi3mr_os.c
index c740a64164e5..6f1a9472675d 100644
--- a/drivers/scsi/mpi3mr/mpi3mr_os.c
+++ b/drivers/scsi/mpi3mr/mpi3mr_os.c
@@ -5972,6 +5972,8 @@ mpi3mr_pcierr_error_detected(struct pci_dev *pdev, pci_channel_state_t state)
 			return PCI_ERS_RESULT_DISCONNECT;
 		}
 
+		mrioc->stop_drv_processing = 1;
+		mpi3mr_cleanup_fwevt_list(mrioc);
 		scsi_block_requests(mrioc->shost);
 		mpi3mr_stop_watchdog(mrioc);
 		mpi3mr_cleanup_resources(mrioc);
@@ -6069,6 +6071,7 @@ static void mpi3mr_pcierr_resume(struct pci_dev *pdev)
 
 	if (mrioc->block_on_pci_err) {
 		mrioc->block_on_pci_err = false;
+		mrioc->stop_drv_processing = 0;
 		scsi_unblock_requests(shost);
 		mpi3mr_start_watchdog(mrioc);
 	}