From: Greg Kroah-Hartman Date: Tue, 9 Apr 2024 13:20:39 +0000 (+0200) Subject: drop scsi patch, again. X-Git-Tag: v5.15.154~9 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a0f0ce228535b3de1d61302e9dd4a59595bc1ccf;p=thirdparty%2Fkernel%2Fstable-queue.git drop scsi patch, again. --- diff --git a/queue-6.6/scsi-sg-avoid-sg-device-teardown-race.patch b/queue-6.6/scsi-sg-avoid-sg-device-teardown-race.patch deleted file mode 100644 index 0b16b1ef9f5..00000000000 --- a/queue-6.6/scsi-sg-avoid-sg-device-teardown-race.patch +++ /dev/null @@ -1,56 +0,0 @@ -From 735728cdaa3444338a870da6701fa0e8b82b9c88 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Wed, 20 Mar 2024 22:30:32 +0100 -Subject: scsi: sg: Avoid sg device teardown race - -From: Alexander Wetzel - -[ Upstream commit 27f58c04a8f438078583041468ec60597841284d ] - -sg_remove_sfp_usercontext() must not use sg_device_destroy() after calling -scsi_device_put(). - -sg_device_destroy() is accessing the parent scsi_device request_queue which -will already be set to NULL when the preceding call to scsi_device_put() -removed the last reference to the parent scsi_device. - -The resulting NULL pointer exception will then crash the kernel. - -Link: https://lore.kernel.org/r/20240305150509.23896-1-Alexander@wetzel-home.de -Fixes: db59133e9279 ("scsi: sg: fix blktrace debugfs entries leakage") -Cc: stable@vger.kernel.org -Signed-off-by: Alexander Wetzel -Link: https://lore.kernel.org/r/20240320213032.18221-1-Alexander@wetzel-home.de -Reviewed-by: Bart Van Assche -Signed-off-by: Martin K. Petersen -Signed-off-by: Sasha Levin ---- - drivers/scsi/sg.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c -index 0d8afffd1683b..8bd95ee1825a6 100644 ---- a/drivers/scsi/sg.c -+++ b/drivers/scsi/sg.c -@@ -2208,6 +2208,7 @@ sg_remove_sfp_usercontext(struct work_struct *work) - { - struct sg_fd *sfp = container_of(work, struct sg_fd, ew.work); - struct sg_device *sdp = sfp->parentdp; -+ struct scsi_device *device = sdp->device; - Sg_request *srp; - unsigned long iflags; - -@@ -2233,8 +2234,9 @@ sg_remove_sfp_usercontext(struct work_struct *work) - "sg_remove_sfp: sfp=0x%p\n", sfp)); - kfree(sfp); - -- scsi_device_put(sdp->device); -+ WARN_ON_ONCE(kref_read(&sdp->d_ref) != 1); - kref_put(&sdp->d_ref, sg_device_destroy); -+ scsi_device_put(device); - module_put(THIS_MODULE); - } - --- -2.43.0 - diff --git a/queue-6.6/series b/queue-6.6/series index 8ed89aa982f..efa6230c22d 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -128,7 +128,6 @@ octeontx2-pf-check-negative-error-code-in-otx2_open.patch octeontx2-af-add-array-index-check.patch i40e-fix-i40e_count_filters-to-count-only-active-new-filters.patch i40e-fix-vf-may-be-used-uninitialized-in-this-function-warning.patch -scsi-sg-avoid-sg-device-teardown-race.patch usb-typec-ucsi-fix-race-between-typec_switch-and-rol.patch drm-amd-display-fix-dpstream-clk-on-and-off-sequence.patch drm-amd-display-prevent-crash-when-disable-stream.patch diff --git a/queue-6.8/scsi-sg-avoid-sg-device-teardown-race.patch b/queue-6.8/scsi-sg-avoid-sg-device-teardown-race.patch deleted file mode 100644 index 4884eda153f..00000000000 --- a/queue-6.8/scsi-sg-avoid-sg-device-teardown-race.patch +++ /dev/null @@ -1,56 +0,0 @@ -From 959f530354e02b9de6f7881102dbae6053e4c6a4 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Wed, 20 Mar 2024 22:30:32 +0100 -Subject: scsi: sg: Avoid sg device teardown race - -From: Alexander Wetzel - -[ Upstream commit 27f58c04a8f438078583041468ec60597841284d ] - -sg_remove_sfp_usercontext() must not use sg_device_destroy() after calling -scsi_device_put(). - -sg_device_destroy() is accessing the parent scsi_device request_queue which -will already be set to NULL when the preceding call to scsi_device_put() -removed the last reference to the parent scsi_device. - -The resulting NULL pointer exception will then crash the kernel. - -Link: https://lore.kernel.org/r/20240305150509.23896-1-Alexander@wetzel-home.de -Fixes: db59133e9279 ("scsi: sg: fix blktrace debugfs entries leakage") -Cc: stable@vger.kernel.org -Signed-off-by: Alexander Wetzel -Link: https://lore.kernel.org/r/20240320213032.18221-1-Alexander@wetzel-home.de -Reviewed-by: Bart Van Assche -Signed-off-by: Martin K. Petersen -Signed-off-by: Sasha Levin ---- - drivers/scsi/sg.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c -index 86210e4dd0d35..ff6894ce5404e 100644 ---- a/drivers/scsi/sg.c -+++ b/drivers/scsi/sg.c -@@ -2207,6 +2207,7 @@ sg_remove_sfp_usercontext(struct work_struct *work) - { - struct sg_fd *sfp = container_of(work, struct sg_fd, ew.work); - struct sg_device *sdp = sfp->parentdp; -+ struct scsi_device *device = sdp->device; - Sg_request *srp; - unsigned long iflags; - -@@ -2232,8 +2233,9 @@ sg_remove_sfp_usercontext(struct work_struct *work) - "sg_remove_sfp: sfp=0x%p\n", sfp)); - kfree(sfp); - -- scsi_device_put(sdp->device); -+ WARN_ON_ONCE(kref_read(&sdp->d_ref) != 1); - kref_put(&sdp->d_ref, sg_device_destroy); -+ scsi_device_put(device); - module_put(THIS_MODULE); - } - --- -2.43.0 - diff --git a/queue-6.8/series b/queue-6.8/series index fa8cbce5e19..04cde82a958 100644 --- a/queue-6.8/series +++ b/queue-6.8/series @@ -127,7 +127,6 @@ octeontx2-af-add-array-index-check.patch i40e-fix-i40e_count_filters-to-count-only-active-new-filters.patch i40e-fix-vf-may-be-used-uninitialized-in-this-function-warning.patch i40e-enforce-software-interrupt-during-busy-poll-exit.patch -scsi-sg-avoid-sg-device-teardown-race.patch drm-amd-flush-gfxoff-requests-in-prepare-stage.patch e1000e-minor-flow-correction-in-e1000_shutdown-funct.patch e1000e-move-force-smbus-from-enable-ulp-function-to-.patch