From: Alexander Wetzel <Alexander@wetzel-home.de> To: dgilbert@interlog.com Cc: gregkh@linuxfoundation.org, sachinp@linux.ibm.com, Alexander@wetzel-home.de, bvanassche@acm.org, linux-scsi@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, martin.petersen@oracle.com, stable@vger.kernel.org Subject: [PATCH v3] scsi: sg: Avoid race in error handling & drop bogus warn Date: Mon, 1 Apr 2024 21:10:38 +0200 [thread overview] Message-ID: <20240401191038.18359-1-Alexander@wetzel-home.de> (raw) In-Reply-To: <81266270-42F4-48F9-9139-8F0C3F0A6553@linux.ibm.com> commit 27f58c04a8f4 ("scsi: sg: Avoid sg device teardown race") introduced an incorrect WARN_ON_ONCE() and missed a sequence where sg_device_destroy() was used after scsi_device_put(). sg_device_destroy() is accessing the parent scsi_device request_queue which will already be set to NULL when the preceding call to scsi_device_put() removed the last reference to the parent scsi_device. Drop the incorrect WARN_ON_ONCE() - allowing more than one concurrent access to the sg device - and make sure sg_device_destroy() is not used after scsi_device_put() in the error handling. Link: https://lore.kernel.org/all/5375B275-D137-4D5F-BE25-6AF8ACAE41EF@linux.ibm.com Fixes: 27f58c04a8f4 ("scsi: sg: Avoid sg device teardown race") Cc: stable@vger.kernel.org Signed-off-by: Alexander Wetzel <Alexander@wetzel-home.de> --- Changes compared to V1: fixed commit message Changes compared to V2: Fix use-after free --- drivers/scsi/sg.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c index 386981c6976a..baf870a03ecf 100644 --- a/drivers/scsi/sg.c +++ b/drivers/scsi/sg.c @@ -285,6 +285,7 @@ sg_open(struct inode *inode, struct file *filp) int dev = iminor(inode); int flags = filp->f_flags; struct request_queue *q; + struct scsi_device *device; Sg_device *sdp; Sg_fd *sfp; int retval; @@ -301,11 +302,12 @@ sg_open(struct inode *inode, struct file *filp) /* This driver's module count bumped by fops_get in <linux/fs.h> */ /* Prevent the device driver from vanishing while we sleep */ - retval = scsi_device_get(sdp->device); + device = sdp->device; + retval = scsi_device_get(device); if (retval) goto sg_put; - retval = scsi_autopm_get_device(sdp->device); + retval = scsi_autopm_get_device(device); if (retval) goto sdp_put; @@ -313,7 +315,7 @@ sg_open(struct inode *inode, struct file *filp) * check if O_NONBLOCK. Permits SCSI commands to be issued * during error recovery. Tread carefully. */ if (!((flags & O_NONBLOCK) || - scsi_block_when_processing_errors(sdp->device))) { + scsi_block_when_processing_errors(device))) { retval = -ENXIO; /* we are in error recovery for this device */ goto error_out; @@ -344,7 +346,7 @@ sg_open(struct inode *inode, struct file *filp) if (sdp->open_cnt < 1) { /* no existing opens */ sdp->sgdebug = 0; - q = sdp->device->request_queue; + q = device->request_queue; sdp->sg_tablesize = queue_max_segments(q); } sfp = sg_add_sfp(sdp); @@ -370,10 +372,11 @@ sg_open(struct inode *inode, struct file *filp) error_mutex_locked: mutex_unlock(&sdp->open_rel_lock); error_out: - scsi_autopm_put_device(sdp->device); + scsi_autopm_put_device(device); sdp_put: - scsi_device_put(sdp->device); - goto sg_put; + kref_put(&sdp->d_ref, sg_device_destroy); + scsi_device_put(device); + return retval; } /* Release resources associated with a successful sg_open() @@ -2233,7 +2236,6 @@ sg_remove_sfp_usercontext(struct work_struct *work) "sg_remove_sfp: sfp=0x%p\n", sfp)); kfree(sfp); - WARN_ON_ONCE(kref_read(&sdp->d_ref) != 1); kref_put(&sdp->d_ref, sg_device_destroy); scsi_device_put(device); module_put(THIS_MODULE); -- 2.44.0
WARNING: multiple messages have this Message-ID (diff)
From: Alexander Wetzel <Alexander@wetzel-home.de> To: dgilbert@interlog.com Cc: bvanassche@acm.org, linux-scsi@vger.kernel.org, gregkh@linuxfoundation.org, stable@vger.kernel.org, Alexander@wetzel-home.de, sachinp@linux.ibm.com, martin.petersen@oracle.com, linuxppc-dev@lists.ozlabs.org Subject: [PATCH v3] scsi: sg: Avoid race in error handling & drop bogus warn Date: Mon, 1 Apr 2024 21:10:38 +0200 [thread overview] Message-ID: <20240401191038.18359-1-Alexander@wetzel-home.de> (raw) In-Reply-To: <81266270-42F4-48F9-9139-8F0C3F0A6553@linux.ibm.com> commit 27f58c04a8f4 ("scsi: sg: Avoid sg device teardown race") introduced an incorrect WARN_ON_ONCE() and missed a sequence where sg_device_destroy() was used after scsi_device_put(). sg_device_destroy() is accessing the parent scsi_device request_queue which will already be set to NULL when the preceding call to scsi_device_put() removed the last reference to the parent scsi_device. Drop the incorrect WARN_ON_ONCE() - allowing more than one concurrent access to the sg device - and make sure sg_device_destroy() is not used after scsi_device_put() in the error handling. Link: https://lore.kernel.org/all/5375B275-D137-4D5F-BE25-6AF8ACAE41EF@linux.ibm.com Fixes: 27f58c04a8f4 ("scsi: sg: Avoid sg device teardown race") Cc: stable@vger.kernel.org Signed-off-by: Alexander Wetzel <Alexander@wetzel-home.de> --- Changes compared to V1: fixed commit message Changes compared to V2: Fix use-after free --- drivers/scsi/sg.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c index 386981c6976a..baf870a03ecf 100644 --- a/drivers/scsi/sg.c +++ b/drivers/scsi/sg.c @@ -285,6 +285,7 @@ sg_open(struct inode *inode, struct file *filp) int dev = iminor(inode); int flags = filp->f_flags; struct request_queue *q; + struct scsi_device *device; Sg_device *sdp; Sg_fd *sfp; int retval; @@ -301,11 +302,12 @@ sg_open(struct inode *inode, struct file *filp) /* This driver's module count bumped by fops_get in <linux/fs.h> */ /* Prevent the device driver from vanishing while we sleep */ - retval = scsi_device_get(sdp->device); + device = sdp->device; + retval = scsi_device_get(device); if (retval) goto sg_put; - retval = scsi_autopm_get_device(sdp->device); + retval = scsi_autopm_get_device(device); if (retval) goto sdp_put; @@ -313,7 +315,7 @@ sg_open(struct inode *inode, struct file *filp) * check if O_NONBLOCK. Permits SCSI commands to be issued * during error recovery. Tread carefully. */ if (!((flags & O_NONBLOCK) || - scsi_block_when_processing_errors(sdp->device))) { + scsi_block_when_processing_errors(device))) { retval = -ENXIO; /* we are in error recovery for this device */ goto error_out; @@ -344,7 +346,7 @@ sg_open(struct inode *inode, struct file *filp) if (sdp->open_cnt < 1) { /* no existing opens */ sdp->sgdebug = 0; - q = sdp->device->request_queue; + q = device->request_queue; sdp->sg_tablesize = queue_max_segments(q); } sfp = sg_add_sfp(sdp); @@ -370,10 +372,11 @@ sg_open(struct inode *inode, struct file *filp) error_mutex_locked: mutex_unlock(&sdp->open_rel_lock); error_out: - scsi_autopm_put_device(sdp->device); + scsi_autopm_put_device(device); sdp_put: - scsi_device_put(sdp->device); - goto sg_put; + kref_put(&sdp->d_ref, sg_device_destroy); + scsi_device_put(device); + return retval; } /* Release resources associated with a successful sg_open() @@ -2233,7 +2236,6 @@ sg_remove_sfp_usercontext(struct work_struct *work) "sg_remove_sfp: sfp=0x%p\n", sfp)); kfree(sfp); - WARN_ON_ONCE(kref_read(&sdp->d_ref) != 1); kref_put(&sdp->d_ref, sg_device_destroy); scsi_device_put(device); module_put(THIS_MODULE); -- 2.44.0
next prev parent reply other threads:[~2024-04-01 19:11 UTC|newest] Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top 2024-03-29 9:08 [powerpc] WARN at drivers/scsi/sg.c:2236 (sg_remove_sfp_usercontext) Sachin Sant 2024-03-29 9:08 ` Sachin Sant 2024-03-29 11:10 ` Alexander Wetzel 2024-03-29 11:10 ` Alexander Wetzel 2024-03-29 14:37 ` Sachin Sant 2024-04-01 9:56 ` [PATCH] scsi: sg: Avoid race in error handling & drop bogus warn Alexander Wetzel 2024-04-01 9:56 ` Alexander Wetzel 2024-04-01 10:03 ` [PATCH v2] " Alexander Wetzel 2024-04-01 10:03 ` Alexander Wetzel 2024-04-01 17:09 ` Bart Van Assche 2024-04-01 17:09 ` Bart Van Assche 2024-04-01 19:01 ` Alexander Wetzel 2024-04-01 19:01 ` Alexander Wetzel 2024-04-01 19:10 ` Alexander Wetzel [this message] 2024-04-01 19:10 ` [PATCH v3] " Alexander Wetzel 2024-04-02 6:01 ` Sachin Sant 2024-04-02 6:01 ` Sachin Sant 2024-04-03 23:24 ` Bart Van Assche 2024-04-03 23:24 ` Bart Van Assche 2024-04-04 6:55 ` Alexander Wetzel 2024-04-04 6:55 ` Alexander Wetzel 2024-04-04 16:34 ` Bart Van Assche 2024-04-04 16:34 ` Bart Van Assche 2024-04-04 22:22 ` Martin K. Petersen 2024-04-04 22:22 ` Martin K. Petersen 2024-04-06 1:58 ` Martin K. Petersen 2024-04-06 1:58 ` Martin K. Petersen
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20240401191038.18359-1-Alexander@wetzel-home.de \ --to=alexander@wetzel-home.de \ --cc=bvanassche@acm.org \ --cc=dgilbert@interlog.com \ --cc=gregkh@linuxfoundation.org \ --cc=linux-scsi@vger.kernel.org \ --cc=linuxppc-dev@lists.ozlabs.org \ --cc=martin.petersen@oracle.com \ --cc=sachinp@linux.ibm.com \ --cc=stable@vger.kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.