[ Sasha's backport helper bot ]
Hi,
The upstream commit SHA1 provided is correct: f10593ad9bc36921f623361c9e3dd96bd52d85ee
WARNING: Author mismatch between patch and upstream commit: Backport author: hsimeliere.opensource@witekio.com Commit author: Suraj Sonawanesurajsonawane0215@gmail.com
Status in newer kernel trees: 6.12.y | Present (different SHA1: 1f5e2f1ca587) 6.6.y | Present (different SHA1: 59b30afa5786) 6.1.y | Not found
Note: The patch differs from the upstream commit: --- 1: f10593ad9bc36 ! 1: 6931ce4ecfe44 scsi: sg: Fix slab-use-after-free read in sg_release() @@ Metadata ## Commit message ## scsi: sg: Fix slab-use-after-free read in sg_release()
+ [ Upstream commit f10593ad9bc36921f623361c9e3dd96bd52d85ee ] + Fix a use-after-free bug in sg_release(), detected by syzbot with KASAN:
BUG: KASAN: slab-use-after-free in lock_release+0x151/0xa30 @@ Commit message Link: https://lore.kernel.org/r/20241120125944.88095-1-surajsonawane0215@gmail.com Reviewed-by: Bart Van Assche bvanassche@acm.org Signed-off-by: Martin K. Petersen martin.petersen@oracle.com + Signed-off-by: BRUNO VERNAY bruno.vernay@se.com + Signed-off-by: Hugo SIMELIERE hsimeliere.opensource@witekio.com
## drivers/scsi/sg.c ## @@ drivers/scsi/sg.c: sg_release(struct inode *inode, struct file *filp) - SCSI_LOG_TIMEOUT(3, sg_printk(KERN_INFO, sdp, "sg_release\n"));
mutex_lock(&sdp->open_rel_lock); + scsi_autopm_put_device(sdp->device); - kref_put(&sfp->f_ref, sg_remove_sfp); sdp->open_cnt--;
---
Results of testing on various branches:
| Branch | Patch Apply | Build Test | |---------------------------|-------------|------------| | stable/linux-6.1.y | Success | Success | | stable/linux-5.4.y | Success | Success |