From: Alexander Wetzel <Alexander@wetzel-home.de>
To: dgilbert@interlog.com
Cc: gregkh@linuxfoundation.org, sachinp@linux.ibm.com,
Alexander@wetzel-home.de, bvanassche@acm.org,
linux-scsi@vger.kernel.org, linuxppc-dev@lists.ozlabs.org,
martin.petersen@oracle.com, stable@vger.kernel.org
Subject: [PATCH] scsi: sg: Avoid race in error handling & drop bogus warn
Date: Mon, 1 Apr 2024 11:56:29 +0200 [thread overview]
Message-ID: <20240401095629.5089-1-Alexander@wetzel-home.de> (raw)
In-Reply-To: <81266270-42F4-48F9-9139-8F0C3F0A6553@linux.ibm.com>
commit 27f58c04a8f4 ("scsi: sg: Avoid sg device teardown race")
introduced an incorrect WARN_ON_ONCE() and missed a sequence where
sg_device_destroy() after scsi_device_put() when handling errors.
sg_device_destroy() is accessing the parent scsi_device request_queue which
will already be set to NULL when the preceding call to scsi_device_put()
removed the last reference to the parent scsi_device.
Drop the incorrect WARN_ON_ONCE() - allowing more than one concurrent
access to the sg device - and make sure sg_device_destroy() is not used
after scsi_device_put() in the error handling.
Link: https://lore.kernel.org/all/5375B275-D137-4D5F-BE25-6AF8ACAE41EF@linux.ibm.com
Fixes: 27f58c04a8f4 ("scsi: sg: Avoid sg device teardown race")
Cc: stable@vger.kernel.org
Signed-off-by: Alexander Wetzel <Alexander@wetzel-home.de>
---
The WARN_ON_ONCE() was kind of stupid to add:
We get add reference for each sg_open(). So opening a second session and
then closing either one will trigger the warning... Nothing to warn
about here.
Alexander
---
drivers/scsi/sg.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index 386981c6976a..833c9277419b 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -372,8 +372,9 @@ sg_open(struct inode *inode, struct file *filp)
error_out:
scsi_autopm_put_device(sdp->device);
sdp_put:
+ kref_put(&sdp->d_ref, sg_device_destroy);
scsi_device_put(sdp->device);
- goto sg_put;
+ return retval;
}
/* Release resources associated with a successful sg_open()
@@ -2233,7 +2234,6 @@ sg_remove_sfp_usercontext(struct work_struct *work)
"sg_remove_sfp: sfp=0x%p\n", sfp));
kfree(sfp);
- WARN_ON_ONCE(kref_read(&sdp->d_ref) != 1);
kref_put(&sdp->d_ref, sg_device_destroy);
scsi_device_put(device);
module_put(THIS_MODULE);
--
2.44.0
WARNING: multiple messages have this Message-ID (diff)
From: Alexander Wetzel <Alexander@wetzel-home.de>
To: dgilbert@interlog.com
Cc: bvanassche@acm.org, linux-scsi@vger.kernel.org,
gregkh@linuxfoundation.org, stable@vger.kernel.org,
Alexander@wetzel-home.de, sachinp@linux.ibm.com,
martin.petersen@oracle.com, linuxppc-dev@lists.ozlabs.org
Subject: [PATCH] scsi: sg: Avoid race in error handling & drop bogus warn
Date: Mon, 1 Apr 2024 11:56:29 +0200 [thread overview]
Message-ID: <20240401095629.5089-1-Alexander@wetzel-home.de> (raw)
In-Reply-To: <81266270-42F4-48F9-9139-8F0C3F0A6553@linux.ibm.com>
commit 27f58c04a8f4 ("scsi: sg: Avoid sg device teardown race")
introduced an incorrect WARN_ON_ONCE() and missed a sequence where
sg_device_destroy() after scsi_device_put() when handling errors.
sg_device_destroy() is accessing the parent scsi_device request_queue which
will already be set to NULL when the preceding call to scsi_device_put()
removed the last reference to the parent scsi_device.
Drop the incorrect WARN_ON_ONCE() - allowing more than one concurrent
access to the sg device - and make sure sg_device_destroy() is not used
after scsi_device_put() in the error handling.
Link: https://lore.kernel.org/all/5375B275-D137-4D5F-BE25-6AF8ACAE41EF@linux.ibm.com
Fixes: 27f58c04a8f4 ("scsi: sg: Avoid sg device teardown race")
Cc: stable@vger.kernel.org
Signed-off-by: Alexander Wetzel <Alexander@wetzel-home.de>
---
The WARN_ON_ONCE() was kind of stupid to add:
We get add reference for each sg_open(). So opening a second session and
then closing either one will trigger the warning... Nothing to warn
about here.
Alexander
---
drivers/scsi/sg.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index 386981c6976a..833c9277419b 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -372,8 +372,9 @@ sg_open(struct inode *inode, struct file *filp)
error_out:
scsi_autopm_put_device(sdp->device);
sdp_put:
+ kref_put(&sdp->d_ref, sg_device_destroy);
scsi_device_put(sdp->device);
- goto sg_put;
+ return retval;
}
/* Release resources associated with a successful sg_open()
@@ -2233,7 +2234,6 @@ sg_remove_sfp_usercontext(struct work_struct *work)
"sg_remove_sfp: sfp=0x%p\n", sfp));
kfree(sfp);
- WARN_ON_ONCE(kref_read(&sdp->d_ref) != 1);
kref_put(&sdp->d_ref, sg_device_destroy);
scsi_device_put(device);
module_put(THIS_MODULE);
--
2.44.0
next prev parent reply other threads:[~2024-04-01 9:57 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-03-29 9:08 [powerpc] WARN at drivers/scsi/sg.c:2236 (sg_remove_sfp_usercontext) Sachin Sant
2024-03-29 9:08 ` Sachin Sant
2024-03-29 11:10 ` Alexander Wetzel
2024-03-29 11:10 ` Alexander Wetzel
2024-03-29 14:37 ` Sachin Sant
2024-04-01 9:56 ` Alexander Wetzel [this message]
2024-04-01 9:56 ` [PATCH] scsi: sg: Avoid race in error handling & drop bogus warn Alexander Wetzel
2024-04-01 10:03 ` [PATCH v2] " Alexander Wetzel
2024-04-01 10:03 ` Alexander Wetzel
2024-04-01 17:09 ` Bart Van Assche
2024-04-01 17:09 ` Bart Van Assche
2024-04-01 19:01 ` Alexander Wetzel
2024-04-01 19:01 ` Alexander Wetzel
2024-04-01 19:10 ` [PATCH v3] " Alexander Wetzel
2024-04-01 19:10 ` Alexander Wetzel
2024-04-02 6:01 ` Sachin Sant
2024-04-02 6:01 ` Sachin Sant
2024-04-03 23:24 ` Bart Van Assche
2024-04-03 23:24 ` Bart Van Assche
2024-04-04 6:55 ` Alexander Wetzel
2024-04-04 6:55 ` Alexander Wetzel
2024-04-04 16:34 ` Bart Van Assche
2024-04-04 16:34 ` Bart Van Assche
2024-04-04 22:22 ` Martin K. Petersen
2024-04-04 22:22 ` Martin K. Petersen
2024-04-06 1:58 ` Martin K. Petersen
2024-04-06 1:58 ` Martin K. Petersen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240401095629.5089-1-Alexander@wetzel-home.de \
--to=alexander@wetzel-home.de \
--cc=bvanassche@acm.org \
--cc=dgilbert@interlog.com \
--cc=gregkh@linuxfoundation.org \
--cc=linux-scsi@vger.kernel.org \
--cc=linuxppc-dev@lists.ozlabs.org \
--cc=martin.petersen@oracle.com \
--cc=sachinp@linux.ibm.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.