scsi: sg: close race condition in sg_remove_sfp_usercontext()

commit 97d27b0dd015e980ade63fda111fd1353276e28b upstream.

sg_remove_sfp_usercontext() is clearing any sg requests, but needs to
take 'rq_list_lock' when modifying the list.

Reported-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Hannes Reinecke <hare@suse.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Tested-by: Johannes Thumshirn <jthumshirn@suse.de>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index 198e60a004a6141fbc766f2f31780015bc50e390..4a1a0d74a51f522e3de2912ebf98260d5a56a673 100644 (file)
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -561,6 +561,7 @@ sg_read(struct file *filp, char __user *buf, size_t count, loff_t * ppos)
        } else
                count = (old_hdr->result == 0) ? 0 : -EIO;
        sg_finish_rem_req(srp);
+       sg_remove_request(sfp, srp);
        retval = count;
 free_old_hdr:
        kfree(old_hdr);
@@ -601,6 +602,7 @@ sg_new_read(Sg_fd * sfp, char __user *buf, size_t count, Sg_request * srp)
        }
 err_out:
        err2 = sg_finish_rem_req(srp);
+       sg_remove_request(sfp, srp);
        return err ? : err2 ? : count;
 }
 
@@ -835,6 +837,7 @@ sg_common_write(Sg_fd * sfp, Sg_request * srp,
        if (k) {
                SCSI_LOG_TIMEOUT(1, printk("sg_common_write: start_req err=%d\n", k));
                sg_finish_rem_req(srp);
+               sg_remove_request(sfp, srp);
                return k;       /* probably out of space --> ENOMEM */
        }
        if (atomic_read(&sdp->detaching)) {
@@ -844,6 +847,7 @@ sg_common_write(Sg_fd * sfp, Sg_request * srp,
                }
 
                sg_finish_rem_req(srp);
+               sg_remove_request(sfp, srp);
                return -ENODEV;
        }
 
@@ -1367,6 +1371,7 @@ sg_rq_end_io_usercontext(struct work_struct *work)
        struct sg_fd *sfp = srp->parentfp;
 
        sg_finish_rem_req(srp);
+       sg_remove_request(sfp, srp);
        kref_put(&sfp->f_ref, sg_remove_sfp);
 }
 
@@ -1876,8 +1881,6 @@ sg_finish_rem_req(Sg_request *srp)
        else
                sg_remove_scat(req_schp);
 
-       sg_remove_request(sfp, srp);
-
        return ret;
 }
 
@@ -2211,12 +2214,17 @@ sg_remove_sfp_usercontext(struct work_struct *work)
        struct sg_fd *sfp = container_of(work, struct sg_fd, ew.work);
        struct sg_device *sdp = sfp->parentdp;
        Sg_request *srp;
+       unsigned long iflags;
 
        /* Cleanup any responses which were never read(). */
+       write_lock_irqsave(&sfp->rq_list_lock, iflags);
        while (!list_empty(&sfp->rq_list)) {
                srp = list_first_entry(&sfp->rq_list, Sg_request, entry);
                sg_finish_rem_req(srp);
+               list_del(&srp->entry);
+               srp->parentfp = NULL;
        }
+       write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
 
        if (sfp->reserve.bufflen > 0) {
                SCSI_LOG_TIMEOUT(6,