CVE-2026-74555: scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race

Commit fbefe22811c3 ("scsi: libsas: Don't always drain event workqueue
for HA resume") introduced sas_resume_ha_no_sync() to avoid a deadlock:
the PHYE_RESUME_TIMEOUT handler, running on the HA event workqueue,
calls sas_deform_port() -> sas_destruct_devices(), which removes SCSI
devices and waits for the host to become runtime-active. But the host
cannot resume until sas_resume_ha() -> sas_drain_work() returns, and the
drain is blocked on that very handler.

However skipping the drain reintroduces a race: hisi_sas returns from
resume before all PHY UP work and libsas discovery work finish. The
controller may then autosuspend while disks are still waking up. The
disks issue IO to a suspended controller, the IO fails, and the disks
get disabled.

Fix the deadlock at its source by moving the PHYE_RESUME_TIMEOUT
notification to after sas_drain_work(). By then the host resume is about
to complete, so device removal through device_link no longer blocks on
the resume and the cycle is broken.

With the deadlock gone, restore sas_resume_ha() (the draining variant)
in hisi_sas and remove sas_resume_ha_no_sync().

The reorder is safe for the other libsas consumers (isci, pm8001,
aic94xx, mvsas). During suspend, sas_suspend_devices() calls
sas_notify_lldd_dev_gone() for each device, which sets dev->lldd_dev to
NULL. When scsi_unblock_requests re-enables I/O in resume, any I/O to a
timed-out phy's disk is immediately rejected by the LLDD before reaching
hardware: isci returns SAS_DEVICE_UNKNOWN (mapped to DID_BAD_TARGET),
and pm8001 returns SAS_PHY_DOWN (mapped to DID_NO_CONNECT). Both
complete directly via scsi_done() without entering SCSI EH. This is
identical in both the old and new ordering since lldd_dev_gone runs
during suspend, before resume. The reorder only affects when the
PHYE_RESUME_TIMEOUT handler runs (synchronized by sas_drain_work()
vs. asynchronous after resume returns), not whether I/O can reach the
device. aic94xx and mvsas do not register any PM ops and never reach
this code path.

The Linux kernel CVE team has assigned CVE-2026-74555 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.17 with commit fbefe22811c3140a686e407e114789ebf328a9a2 and fixed in 6.6.151 with commit e50a6523a603594a6d92cdecfe11997d639410a3
	Issue introduced in 5.17 with commit fbefe22811c3140a686e407e114789ebf328a9a2 and fixed in 6.12.103 with commit c391b5899dd46485a5893696c12ae3e95a3a7325
	Issue introduced in 5.17 with commit fbefe22811c3140a686e407e114789ebf328a9a2 and fixed in 6.18.44 with commit 9e24b47ef81d43b3fb1b14294f09991640c79fcc
	Issue introduced in 5.17 with commit fbefe22811c3140a686e407e114789ebf328a9a2 and fixed in 7.1.8 with commit b9c44a14062093e9fc2d6bddc696cfceadb482d7
	Issue introduced in 5.17 with commit fbefe22811c3140a686e407e114789ebf328a9a2 and fixed in 7.2-rc6 with commit 3dbbbf656b850c9c8de05df6ad4a1dfc6ff02845

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74555
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
	drivers/scsi/libsas/sas_init.c
	include/scsi/libsas.h


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/e50a6523a603594a6d92cdecfe11997d639410a3
	https://git.kernel.org/stable/c/c391b5899dd46485a5893696c12ae3e95a3a7325
	https://git.kernel.org/stable/c/9e24b47ef81d43b3fb1b14294f09991640c79fcc
	https://git.kernel.org/stable/c/b9c44a14062093e9fc2d6bddc696cfceadb482d7
	https://git.kernel.org/stable/c/3dbbbf656b850c9c8de05df6ad4a1dfc6ff02845