Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 97d27b0d authored by Hannes Reinecke's avatar Hannes Reinecke Committed by Martin K. Petersen
Browse files

scsi: sg: close race condition in sg_remove_sfp_usercontext() 



sg_remove_sfp_usercontext() is clearing any sg requests, but needs to
take 'rq_list_lock' when modifying the list.

Reported-by: default avatarChristoph Hellwig <hch@lst.de>
Signed-off-by: default avatarHannes Reinecke <hare@suse.com>
Reviewed-by: default avatarJohannes Thumshirn <jthumshirn@suse.de>
Tested-by: default avatarJohannes Thumshirn <jthumshirn@suse.de>
Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent 109bade9

drivers/scsi/sg.c

+10 −2
Original line number Diff line number Diff line
@@ -524,6 +524,7 @@ sg_read(struct file *filp, char __user *buf, size_t count, loff_t * ppos) 
	} else

		count = (old_hdr->result == 0) ? 0 : -EIO;

	sg_finish_rem_req(srp);

	sg_remove_request(sfp, srp);

	retval = count;

free_old_hdr:

	kfree(old_hdr);
@@ -564,6 +565,7 @@ sg_new_read(Sg_fd * sfp, char __user *buf, size_t count, Sg_request * srp) 
	}

err_out:

	err2 = sg_finish_rem_req(srp);

	sg_remove_request(sfp, srp);

	return err ? : err2 ? : count;

}
@@ -800,6 +802,7 @@ sg_common_write(Sg_fd * sfp, Sg_request * srp, 
		SCSI_LOG_TIMEOUT(1, sg_printk(KERN_INFO, sfp->parentdp,

			"sg_common_write: start_req err=%d\n", k));

		sg_finish_rem_req(srp);

		sg_remove_request(sfp, srp);

		return k;	/* probably out of space --> ENOMEM */

	}

	if (atomic_read(&sdp->detaching)) {
@@ -810,6 +813,7 @@ sg_common_write(Sg_fd * sfp, Sg_request * srp, 
		}



		sg_finish_rem_req(srp);

		sg_remove_request(sfp, srp);

		return -ENODEV;

	}
@@ -1285,6 +1289,7 @@ sg_rq_end_io_usercontext(struct work_struct *work) 
	struct sg_fd *sfp = srp->parentfp;



	sg_finish_rem_req(srp);

	sg_remove_request(sfp, srp);

	kref_put(&sfp->f_ref, sg_remove_sfp);

}
@@ -1831,8 +1836,6 @@ sg_finish_rem_req(Sg_request *srp) 
	else

		sg_remove_scat(sfp, req_schp);



	sg_remove_request(sfp, srp);



	return ret;

}
@@ -2177,12 +2180,17 @@ sg_remove_sfp_usercontext(struct work_struct *work) 
	struct sg_fd *sfp = container_of(work, struct sg_fd, ew.work);

	struct sg_device *sdp = sfp->parentdp;

	Sg_request *srp;

	unsigned long iflags;



	/* Cleanup any responses which were never read(). */

	write_lock_irqsave(&sfp->rq_list_lock, iflags);

	while (!list_empty(&sfp->rq_list)) {

		srp = list_first_entry(&sfp->rq_list, Sg_request, entry);

		sg_finish_rem_req(srp);

		list_del(&srp->entry);

		srp->parentfp = NULL;

	}

	write_unlock_irqrestore(&sfp->rq_list_lock, iflags);



	if (sfp->reserve.bufflen > 0) {

		SCSI_LOG_TIMEOUT(6, sg_printk(KERN_INFO, sdp,