On 20.03.24 12:16, Greg KH wrote:
On Wed, Mar 20, 2024 at 12:08:09PM +0100, Alexander Wetzel wrote:
sg_remove_sfp_usercontext() must not use sg_device_destroy() after calling scsi_device_put().
sg_device_destroy() is accessing the parent scsi device request_queue. Which will already be set to NULL when the preceding call to scsi_device_put() removed the last reference to the parent scsi device.
The resulting NULL pointer exception will then crash the kernel.
Link: https://lore.kernel.org/r/20240305150509.23896-1-Alexander@wetzel-home.de Cc: stable@vger.kernel.org Signed-off-by: Alexander Wetzel Alexander@wetzel-home.de
Changes compared to V1: Reworked the commit message
What commit id does this fix?
It's a combination of patches. I think db59133e9279 ("scsi: sg: fix blktrace debugfs entries leakage") was the one which finally broke it.
The in the hindsight wrong sequence was introduced via: c6517b7942fa ("[SCSI] sg: fix races during device removal") and cc833acbee9d ("sg: O_EXCL and other lock handling")
Alexander