❌ FAIL (MISSED 10 of 54): Test report for for-kernelci (7.4.0-rc1, upstream-arm-next, 6628e7d4)

❌ FAIL (MISSED 10 of 54): Test report for for-kernelci (7.4.0-rc1, upstream-arm-next, 6628e7d4)

[cki-project]

Hi, we tested your kernel and here are the results:

    Overall result: FAILED
             Merge: OK
           Compile: OK
              Test: FAILED


Kernel information:
    Commit message: Linux 7.4-rc1

You can find all the details about the test run at
    https://datawarehouse.cki-project.org/kcidb/checkouts/redhat:3017229113

One or more kernel tests failed:
    Unrecognized or new issues:
        Boot test
             aarch64
                   Logs: https://datawarehouse.cki-project.org/kcidb/tests/redhat:3017229113_aarch64_kernel_kcidb_tool_1200606255_6
                   Non-passing ran subtests:
                       ❌ FAIL Panic: Oops:
                       ⚡ ERROR Warn: External Watchdog Expired
        Storage - blktests - throtl
             aarch64
                   Logs: https://datawarehouse.cki-project.org/kcidb/tests/redhat:3017229113_aarch64_kernel_kcidb_tool_1200606256_8
                   Non-passing ran subtests:
                       ❌ FAIL Panic: Oops:
                       ⚡ ERROR Warn: External Watchdog Expired

    We also see the following known issues which are not related to your changes:
        Issue: [upstream] Hardware - Firmware test suite - auto-waive failures
            URL: https://gitlab.com/cki-project/infrastructure/-/issues/779
            Affected tests:
                Hardware - Firmware test suite [aarch64]
        Issue: selinux-policy: serge-testsuite: Client ioctl BINDER_WRITE_READ error: Invalid argument
            URL: https://lore.kernel.org/selinux/CAAUqJDt1pXQ2KVBvMoMiDrzz8ishonqhQ0nnQLEppot4nmv9Bw@mail.gmail.com/T/
            Affected tests:
                selinux-policy: serge-testsuite [aarch64]


Tests that were not ran because of internal issues:
    /distribution/command [aarch64]
    Reboot test [aarch64]
    Storage - blktests - throtl [aarch64]
    Storage - blktests - ublk [aarch64]
    stress: stress-ng - cpu-cache [aarch64]
    stress: stress-ng - memory [aarch64]


If you find a failure unrelated to your changes, please ask the test maintainer to review it.
This will prevent the failures from being incorrectly reported in the future.

Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.

        ,-.   ,-.
       ( C ) ( K )  Continuous
        `-',-.`-'   Kernel
          ( I )     Integration
           `-'
______________________________________________________________________________

Re: ❌ FAIL (MISSED 10 of 54): Test report for for-kernelci (7.4.0-rc1, upstream-arm-next, 6628e7d4)

[Catalin Marinas]

On Mon, Nov 02, 2026 at 01:53:04PM -0000, cki-project@redhat.com wrote:
> Hi, we tested your kernel and here are the results:
> 
>     Overall result: FAILED
>              Merge: OK
>            Compile: OK
>               Test: FAILED
> 
> 
> Kernel information:
>     Commit message: Linux 7.4-rc1
> 
> You can find all the details about the test run at
>     https://datawarehouse.cki-project.org/kcidb/checkouts/redhat:3017229113
> 
> One or more kernel tests failed:
>     Unrecognized or new issues:
>         Boot test
>              aarch64
>                    Logs: https://datawarehouse.cki-project.org/kcidb/tests/redhat:3017229113_aarch64_kernel_kcidb_tool_1200606255_6
>                    Non-passing ran subtests:
>                        ❌ FAIL Panic: Oops:
>                        ⚡ ERROR Warn: External Watchdog Expired

This one doesn't seem to have a console log.

>         Storage - blktests - throtl
>              aarch64
>                    Logs: https://datawarehouse.cki-project.org/kcidb/tests/redhat:3017229113_aarch64_kernel_kcidb_tool_1200606256_8
>                    Non-passing ran subtests:
>                        ❌ FAIL Panic: Oops:
>                        ⚡ ERROR Warn: External Watchdog Expired

Kernel panic here but not arm64 specific. It looks like a possible
scsi_debug teardown race. IIUC, b402a0dce64a ("scsi: scsi_debug: Fix
create target debugfs failure") fixes the synchronization before target
creation but not on module exit. The bug is probably from f084fe52c640
("scsi: scsi_debug: Add debugfs interface to fail target reset") if I
look at the recent fix.

Adding some linux-scsi people. The panic from the log:

  run blktests throtl/001 at 2026-11-02 12:17:14 
  sd 48:0:0:0: [sdb] Synchronizin 
  sd 48:0:0:0: [sdb] Synchronizing SCSI cache 
  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000098 
  Mem abort info: 
    ESR = 0x0000000096000004 
    EC = 0x25: DABT (current EL), IL = 32 bits 
    SET = 0, FnV = 0 
    EA = 0, S1PTW = 0 
    FSC = 0x04: level 0 translation fault 
  Data abort info: 
    ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 
    CM = 0, WnR = 0, TnD = 0, TagAccess = 0 
    GCS = 0, Overlay = 0, DirtyBit = 0 
  user pgtable: 4k pages, 48-bit VAs, pgdp=000008001137a000 
  [0000000000000098] pgd=0000000000000000, p4d=0000000000000000 
  Internal error: Oops: 0000000096000004 [#1]  SMP 
  Modules linked in: null_blk scsi_debug(-) sunrpc rfkill vfat fat cppc_cpufreq acpi_ipmi ipmi_ssif ipmi_devintf ipmi_msghandler igb arm_spe_pmu arm_dmc620_pmu arm_cmn arm_dsu_pmu acpi_tad acpiphp_ampere_altra fuse zram lz4hc_compress xfs ghash_ce onboard_usb_dev gf128mul sbsa_gwdt ast i2c_algo_bit xgene_hwmon i2c_dev [last unloaded: null_blk] 
  CPU: 111 UID: 0 PID: 5282 Comm: kworker/u624:1 Not tainted 7.4.0-rc1 #1 PREEMPT(lazy)  
  Hardware name: GIGABYTE R152-P31-00/MP32-AR1-00, BIOS F31n (SCP: 2.10.20220810) 09/30/2022 
  Workqueue: async async_run_entry_fn 
  pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) 
  pc : down_write+0x30/0xc0 
  lr : __simple_recursive_removal+0x64/0x200 
  sp : ffff800087713c70 
  x29: ffff800087713c70 x28: 0000000000000098 x27: 0000000000000000 
  x26: 0000000040000200 x25: 0000000000000200 x24: ffffb32d18b6e0f8 
  x23: 0000000000000001 x22: ffff07ffab302c00 x21: 000000262b740085 
  x20: 0000000000000000 x19: ffff07ffab302c00 x18: 000000000000006f 
  x17: 643d4d4554535953 x16: ffffb32d19b31ac0 x15: ffffb32d1bfe2200 
  x14: 0000000000000000 x13: 0000000000000028 x12: 0101010101010101 
  x11: 7f7f7f7f7f7f7f7f x10: fefefefefefefeff x9 : ffffb32d189f35dc 
  x8 : 00000026177d76b0 x7 : ffffb32d1bfde000 x6 : ffffb32d185cf628 
  x5 : 000000000002d078 x4 : 0000000000000064 x3 : ffffff8000000000 
  x2 : 0000000000000001 x1 : 0000000000000000 x0 : 0000000000000098 
  Call trace: 
   down_write+0x30/0xc0 (P) 
   __simple_recursive_removal+0x64/0x200 
   simple_recursive_removal+0x1c/0x30 
   debugfs_remove+0x64/0x88 
   sdebug_tartget_cleanup_async+0x24/0x48 [scsi_debug] 
   async_run_entry_fn+0x40/0x198 
   process_one_work+0x1b4/0x4b8 
   worker_thread+0x18c/0x2f0 
   kthread+0x128/0x150 
   ret_from_fork+0x10/0x20 
  Code: b9001041 d503201f d2800001 d2800022 (c8e17c02)  

-- 
Catalin

Re: ❌ FAIL (MISSED 10 of 54): Test report for for-kernelci (7.4.0-rc1, upstream-arm-next, 6628e7d4)

[Laurence Oberman]

On Mon, 2026-11-02 at 18:47 +0000, Catalin Marinas wrote:
> On Mon, Nov 02, 2026 at 01:53:04PM -0000,
> cki-project@redhat.com wrote:
> > Hi, we tested your kernel and here are the results:
> > 
> >     Overall result: FAILED
> >              Merge: OK
> >            Compile: OK
> >               Test: FAILED
> > 
> > 
> > Kernel information:
> >     Commit message: Linux 7.4-rc1
> > 
> > You can find all the details about the test run at
> >    
> > https://datawarehouse.cki-project.org/kcidb/checkouts/redhat:3017229113
> > 
> > One or more kernel tests failed:
> >     Unrecognized or new issues:
> >         Boot test
> >              aarch64
> >                    Logs:
> > https://datawarehouse.cki-project.org/kcidb/tests/redhat:3017229113_aarch64_kernel_kcidb_tool_1200606255_6
> >                    Non-passing ran subtests:
> >                        ❌ FAIL Panic: Oops:
> >                        ⚡ ERROR Warn: External Watchdog Expired
> 
> This one doesn't seem to have a console log.
> 
> >         Storage - blktests - throtl
> >              aarch64
> >                    Logs:
> > https://datawarehouse.cki-project.org/kcidb/tests/redhat:3017229113_aarch64_kernel_kcidb_tool_1200606256_8
> >                    Non-passing ran subtests:
> >                        ❌ FAIL Panic: Oops:
> >                        ⚡ ERROR Warn: External Watchdog Expired
> 
> Kernel panic here but not arm64 specific. It looks like a possible
> scsi_debug teardown race. IIUC, b402a0dce64a ("scsi: scsi_debug: Fix
> create target debugfs failure") fixes the synchronization before
> target
> creation but not on module exit. The bug is probably from
> f084fe52c640
> ("scsi: scsi_debug: Add debugfs interface to fail target reset") if I
> look at the recent fix.
> 
> Adding some linux-scsi people. The panic from the log:
> 
>   run blktests throtl/001 at 2026-11-02 12:17:14 
>   sd 48:0:0:0: [sdb] Synchronizin 
>   sd 48:0:0:0: [sdb] Synchronizing SCSI cache 
>   Unable to handle kernel NULL pointer dereference at virtual address
> 0000000000000098 
>   Mem abort info: 
>     ESR = 0x0000000096000004 
>     EC = 0x25: DABT (current EL), IL = 32 bits 
>     SET = 0, FnV = 0 
>     EA = 0, S1PTW = 0 
>     FSC = 0x04: level 0 translation fault 
>   Data abort info: 
>     ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 
>     CM = 0, WnR = 0, TnD = 0, TagAccess = 0 
>     GCS = 0, Overlay = 0, DirtyBit = 0 
>   user pgtable: 4k pages, 48-bit VAs, pgdp=000008001137a000 
>   [0000000000000098] pgd=0000000000000000, p4d=0000000000000000 
>   Internal error: Oops: 0000000096000004 [#1]  SMP 
>   Modules linked in: null_blk scsi_debug(-) sunrpc rfkill vfat fat
> cppc_cpufreq acpi_ipmi ipmi_ssif ipmi_devintf ipmi_msghandler igb
> arm_spe_pmu arm_dmc620_pmu arm_cmn arm_dsu_pmu acpi_tad
> acpiphp_ampere_altra fuse zram lz4hc_compress xfs ghash_ce
> onboard_usb_dev gf128mul sbsa_gwdt ast i2c_algo_bit xgene_hwmon
> i2c_dev [last unloaded: null_blk] 
>   CPU: 111 UID: 0 PID: 5282 Comm: kworker/u624:1 Not tainted 7.4.0-
> rc1 #1 PREEMPT(lazy)  
>   Hardware name: GIGABYTE R152-P31-00/MP32-AR1-00, BIOS F31n (SCP:
> 2.10.20220810) 09/30/2022 
>   Workqueue: async async_run_entry_fn 
>   pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) 
>   pc : down_write+0x30/0xc0 
>   lr : __simple_recursive_removal+0x64/0x200 
>   sp : ffff800087713c70 
>   x29: ffff800087713c70 x28: 0000000000000098 x27: 0000000000000000 
>   x26: 0000000040000200 x25: 0000000000000200 x24: ffffb32d18b6e0f8 
>   x23: 0000000000000001 x22: ffff07ffab302c00 x21: 000000262b740085 
>   x20: 0000000000000000 x19: ffff07ffab302c00 x18: 000000000000006f 
>   x17: 643d4d4554535953 x16: ffffb32d19b31ac0 x15: ffffb32d1bfe2200 
>   x14: 0000000000000000 x13: 0000000000000028 x12: 0101010101010101 
>   x11: 7f7f7f7f7f7f7f7f x10: fefefefefefefeff x9 : ffffb32d189f35dc 
>   x8 : 00000026177d76b0 x7 : ffffb32d1bfde000 x6 : ffffb32d185cf628 
>   x5 : 000000000002d078 x4 : 0000000000000064 x3 : ffffff8000000000 
>   x2 : 0000000000000001 x1 : 0000000000000000 x0 : 0000000000000098 
>   Call trace: 
>    down_write+0x30/0xc0 (P) 
>    __simple_recursive_removal+0x64/0x200 
>    simple_recursive_removal+0x1c/0x30 
>    debugfs_remove+0x64/0x88 
>    sdebug_tartget_cleanup_async+0x24/0x48 [scsi_debug] 
>    async_run_entry_fn+0x40/0x198 
>    process_one_work+0x1b4/0x4b8 
>    worker_thread+0x18c/0x2f0 
>    kthread+0x128/0x150 
>    ret_from_fork+0x10/0x20 
>   Code: b9001041 d503201f d2800001 d2800022 (c8e17c02)  

Subject: Re: ❌ FAIL (MISSED 10 of 54): Test report for for-kernelci
(7.4.0-rc1, upstream-arm-next, 6628e7d4)

Hi,

I agree with the analysis. sdebug_target_destroy() defers removal of
the per-target debugfs directory to sdebug_tartget_cleanup_async() on
sdebug_async_domain. b402a0dce64a added async_synchronize_full_domain()
before target creation, but scsi_debug_exit() still removes the hosts
and goes straight to debugfs_remove(sdebug_debugfs_root) without
waiting for that domain.

So the recursive removal of the root can tear down the per-target
dentries before the pending async work runs. That work then calls
debugfs_remove() on a stale dentry, which matches the NULL inode in
down_write() from __simple_recursive_removal() in the trace. The
pending work can also run after the module text has been freed.

Could you give the test patch below a run with blktests throtl/001 on
the system that hit this? It is untested on my side so far. If it
holds up I will send it formally with your Tested-by.

[TEST PATCH] scsi: scsi_debug: Wait for async target cleanup on module
exit

Fixes: f084fe52c640 ("scsi: scsi_debug: Add debugfs interface to fail
target reset")
Signed-off-by: Laurence Oberman <loberman@redhat.com>
---
 drivers/scsi/scsi_debug.c | 2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -9047,6 +9047,8 @@ static void __exit scsi_debug_exit(void)
 
 	for (; k; k--)
 		sdebug_do_remove_host(true);
+	/* Wait for deferred per-target debugfs cleanup before
removing the root */
+	async_synchronize_full_domain(&sdebug_async_domain);
 	driver_unregister(&sdebug_driverfs_driver);
 	bus_unregister(&pseudo_lld_bus);
 	root_device_unregister(pseudo_primary);

Thanks,
Laurence

[PATCH 0/2] scsi: fix scsi_debug module-exit panic and pseudo target leak

[Laurence Oberman]

CKI reported a NULL pointer dereference in debugfs_remove() from
sdebug_tartget_cleanup_async() while blktests throtl/001 unloaded
scsi_debug on 7.4.0-rc1 (arm64). The bug is not arm64 specific. It
reproduces on x86_64 with KASAN as a slab-use-after-free of the
per-target debugfs dentry.

While fixing it, instrumenting target alloc/destroy in scsi_debug showed
a second, independent problem in the SCSI core: the pseudo SCSI device's
target is never destroyed, because scsi_get_pseudo_sdev() leaks a
reap_ref. With add_host=4 num_tgts=16, ->target_alloc() was called 68
times and ->target_destroy() only 64; the missing four were the
pseudo-device targets at id max_id. Any LLD that sets nr_reserved_cmds
leaks its pseudo target.

Patch 1 fixes the core leak. Patch 2 makes scsi_debug_exit() wait for
the deferred per-target debugfs cleanup before removing the debugfs
root and unloading. Patch 1 was found while testing patch 2, and
patch 2 was tested on top of it.

Testing (x86_64 VM, KASAN, 7.4.0-rc1): loop
"modprobe scsi_debug add_host=4 num_tgts=16; rmmod scsi_debug", with
an msleep(200) temporarily added to sdebug_tartget_cleanup_async() to
force the race window.
  - unpatched: KASAN slab-use-after-free / oops on the first rmmod
  - patch 1: 68 target_alloc / 68 target_destroy, pseudo targets
    destroyed during scsi_remove_host()
  - patches 1+2: 50 iterations clean with the msleep

I had assistatnce from LLM for both of these and ran a local sashiko
which was clean other than a pre-existing issue

Laurence Oberman (2):
  scsi: core: Fix target reap_ref leak in scsi_get_pseudo_sdev()
  scsi: scsi_debug: Wait for async target cleanup on module exit

 drivers/scsi/scsi_debug.c |  2 ++
 drivers/scsi/scsi_scan.c  | 15 ++++++++-------
 2 files changed, 10 insertions(+), 7 deletions(-)

-- 
2.43.0

[PATCH 1/2] scsi: core: Fix target reap_ref leak in scsi_get_pseudo_sdev()

[Laurence Oberman]

scsi_alloc_target() returns a target holding the initial reap_ref from
kref_init(). The scan paths drop that reference with scsi_target_reap()
once they are done with the target; the device allocated under it holds
its own reap_ref, taken in scsi_sysfs_device_initialize() and dropped
by __scsi_remove_device().

scsi_get_pseudo_sdev() only drops the initial reference on the failure
path. On success the pseudo target is left with an extra reap_ref, so
when scsi_forget_host() removes the pseudo device the count only drops
to one and the target is never destroyed: ->target_destroy() is not
called, and the scsi_target, the LLD's per-target data and the
reference the target holds on the host's gendev are leaked.

With scsi_debug (nr_reserved_cmds = 1) this is visible as one target
per host, at id max_id, for which ->target_alloc() is called but
->target_destroy() never is.

Drop the initial reap_ref unconditionally, as the scan paths do. The
pseudo target is then destroyed when the pseudo device is removed.

Fixes: d630fbf6fc8c ("scsi: core: Support allocating a pseudo SCSI device")
Signed-off-by: Laurence Oberman <loberman@redhat.com>
---
 drivers/scsi/scsi_scan.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index 8aae12fd38f3..9ed52724f97c 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -2154,14 +2154,15 @@ struct scsi_device *scsi_get_pseudo_sdev(struct Scsi_Host *shost)
 		goto out;
 
 	sdev = scsi_alloc_sdev(starget, U64_MAX, NULL);
-	if (!sdev) {
-		scsi_target_reap(starget);
-		goto put_target;
-	}
-
-	sdev->borken = 0;
+	if (sdev)
+		sdev->borken = 0;
 
-put_target:
+	/*
+	 * Drop the reap_ref taken by scsi_alloc_target(). If the pseudo device
+	 * was allocated it holds its own reap_ref, which __scsi_remove_device()
+	 * drops, so the target is destroyed when the pseudo device is removed.
+	 */
+	scsi_target_reap(starget);
 	/* See also the get_device(dev) call in scsi_alloc_target(). */
 	put_device(&starget->dev);
 
-- 
2.56.0

[PATCH] scsi: scsi_debug: Wait for async target cleanup on module exit

[Laurence Oberman]

sdebug_target_destroy() is called with the host lock held, so it defers
removal of the per-target debugfs directory to
sdebug_tartget_cleanup_async() on sdebug_async_domain.
scsi_debug_exit() removes the hosts and then removes
sdebug_debugfs_root without waiting for that work. The recursive
removal of the root frees the per-target dentries, and a cleanup that
runs afterwards calls debugfs_remove() on a stale dentry:

  BUG: KASAN: slab-use-after-free in _raw_spin_lock+0x2d/0x40
  Workqueue: async async_run_entry_fn
  Call Trace:
   kasan_report+0x92/0xc0
   _raw_spin_lock+0x2d/0x40
   lockref_get+0x9/0x40
   __simple_recursive_removal+0x35/0x570
   debugfs_remove+0x40/0x60
   sdebug_tartget_cleanup_async+0x43/0x60 [scsi_debug]
   async_run_entry_fn+0x96/0x520
   process_one_work+0x925/0x1910
   worker_thread+0x567/0xcc0
   kthread+0x355/0x450
  Allocated by task 150:
   __d_alloc+0x34/0x9e0
   d_alloc+0x44/0x1d0
   ...
   debugfs_create_dir+0x18/0x3d0
   sdebug_target_alloc
   scsi_alloc_target+0x7c7/0xa70

followed by a NULL inode dereference in down_write() from
__simple_recursive_removal(). CKI hit this running blktests throtl/001
on arm64. The cleanup can also run after the module text has been
freed.

Commit b402a0dce64a ("scsi: scsi_debug: Fix create target debugfs
failure") drains sdebug_async_domain before creating a target. Do the
same in scsi_debug_exit() just before removing the debugfs root, after
the driver has been unregistered so that no host can still be bound and
queue further cleanup work.

Fixes: f084fe52c640 ("scsi: scsi_debug: Add debugfs interface to fail target reset")
Reported-by: Catalin Marinas <catalin.marinas@arm.com>
Closes: https://lore.kernel.org/r/auja2VnJTp-ijxqu@arm.com
Reported-by: CKI Project <cki-project@redhat.com>
Closes: https://datawarehouse.cki-project.org/kcidb/checkouts/redhat:3017229113
Signed-off-by: Laurence Oberman <loberman@redhat.com>
---
 drivers/scsi/scsi_debug.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
index a922c8318a2f..deaed8b3e6c4 100644
--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -9053,6 +9053,8 @@ static void __exit scsi_debug_exit(void)
 
 	sdebug_erase_all_stores(false);
 	xa_destroy(per_store_ap);
+	/* Wait for deferred per-target debugfs cleanup before removing the root */
+	async_synchronize_full_domain(&sdebug_async_domain);
 	debugfs_remove(sdebug_debugfs_root);
 }
 
-- 
2.56.0

Re: [PATCH] scsi: scsi_debug: Wait for async target cleanup on module exit

[Laurence Oberman]

On Tue, 2026-11-03 at 14:32 -0500, Laurence Oberman wrote:
> sdebug_target_destroy() is called with the host lock held, so it
> defers
> removal of the per-target debugfs directory to
> sdebug_tartget_cleanup_async() on sdebug_async_domain.
> scsi_debug_exit() removes the hosts and then removes
> sdebug_debugfs_root without waiting for that work. The recursive
> removal of the root frees the per-target dentries, and a cleanup that
> runs afterwards calls debugfs_remove() on a stale dentry:
> 
>   BUG: KASAN: slab-use-after-free in _raw_spin_lock+0x2d/0x40
>   Workqueue: async async_run_entry_fn
>   Call Trace:
>    kasan_report+0x92/0xc0
>    _raw_spin_lock+0x2d/0x40
>    lockref_get+0x9/0x40
>    __simple_recursive_removal+0x35/0x570
>    debugfs_remove+0x40/0x60
>    sdebug_tartget_cleanup_async+0x43/0x60 [scsi_debug]
>    async_run_entry_fn+0x96/0x520
>    process_one_work+0x925/0x1910
>    worker_thread+0x567/0xcc0
>    kthread+0x355/0x450
>   Allocated by task 150:
>    __d_alloc+0x34/0x9e0
>    d_alloc+0x44/0x1d0
>    ...
>    debugfs_create_dir+0x18/0x3d0
>    sdebug_target_alloc
>    scsi_alloc_target+0x7c7/0xa70
> 
> followed by a NULL inode dereference in down_write() from
> __simple_recursive_removal(). CKI hit this running blktests
> throtl/001
> on arm64. The cleanup can also run after the module text has been
> freed.
> 
> Commit b402a0dce64a ("scsi: scsi_debug: Fix create target debugfs
> failure") drains sdebug_async_domain before creating a target. Do the
> same in scsi_debug_exit() just before removing the debugfs root,
> after
> the driver has been unregistered so that no host can still be bound
> and
> queue further cleanup work.
> 
> Fixes: f084fe52c640 ("scsi: scsi_debug: Add debugfs interface to fail
> target reset")
> Reported-by: Catalin Marinas <catalin.marinas@arm.com>
> Closes: https://lore.kernel.org/r/auja2VnJTp-ijxqu@arm.com
> Reported-by: CKI Project <cki-project@redhat.com>
> Closes:
> https://datawarehouse.cki-project.org/kcidb/checkouts/redhat:3017229113
> Signed-off-by: Laurence Oberman <loberman@redhat.com>
> ---
>  drivers/scsi/scsi_debug.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
> index a922c8318a2f..deaed8b3e6c4 100644
> --- a/drivers/scsi/scsi_debug.c
> +++ b/drivers/scsi/scsi_debug.c
> @@ -9053,6 +9053,8 @@ static void __exit scsi_debug_exit(void)
>  
>  	sdebug_erase_all_stores(false);
>  	xa_destroy(per_store_ap);
> +	/* Wait for deferred per-target debugfs cleanup before
> removing the root */
> +	async_synchronize_full_domain(&sdebug_async_domain);
>  	debugfs_remove(sdebug_debugfs_root);
>  }
>  
Please ignore, this went out without series numbering. Resent as [PATCH
2/2] in reply to the cover letter.

[PATCH 2/2] scsi: scsi_debug: Wait for async target cleanup on module exit

[Laurence Oberman]

sdebug_target_destroy() is called with the host lock held, so it defers
removal of the per-target debugfs directory to
sdebug_tartget_cleanup_async() on sdebug_async_domain.
scsi_debug_exit() removes the hosts and then removes
sdebug_debugfs_root without waiting for that work. The recursive
removal of the root frees the per-target dentries, and a cleanup that
runs afterwards calls debugfs_remove() on a stale dentry:

  BUG: KASAN: slab-use-after-free in _raw_spin_lock+0x2d/0x40
  Workqueue: async async_run_entry_fn
  Call Trace:
   kasan_report+0x92/0xc0
   _raw_spin_lock+0x2d/0x40
   lockref_get+0x9/0x40
   __simple_recursive_removal+0x35/0x570
   debugfs_remove+0x40/0x60
   sdebug_tartget_cleanup_async+0x43/0x60 [scsi_debug]
   async_run_entry_fn+0x96/0x520
   process_one_work+0x925/0x1910
   worker_thread+0x567/0xcc0
   kthread+0x355/0x450
  Allocated by task 150:
   __d_alloc+0x34/0x9e0
   d_alloc+0x44/0x1d0
   ...
   debugfs_create_dir+0x18/0x3d0
   sdebug_target_alloc
   scsi_alloc_target+0x7c7/0xa70

followed by a NULL inode dereference in down_write() from
__simple_recursive_removal(). CKI hit this running blktests throtl/001
on arm64. The cleanup can also run after the module text has been
freed.

Commit b402a0dce64a ("scsi: scsi_debug: Fix create target debugfs
failure") drains sdebug_async_domain before creating a target. Do the
same in scsi_debug_exit() just before removing the debugfs root, after
the driver has been unregistered so that no host can still be bound and
queue further cleanup work.

Fixes: f084fe52c640 ("scsi: scsi_debug: Add debugfs interface to fail target reset")
Reported-by: Catalin Marinas <catalin.marinas@arm.com>
Closes: https://lore.kernel.org/r/auja2VnJTp-ijxqu@arm.com
Reported-by: CKI Project <cki-project@redhat.com>
Closes: https://datawarehouse.cki-project.org/kcidb/checkouts/redhat:3017229113
Signed-off-by: Laurence Oberman <loberman@redhat.com>
---
 drivers/scsi/scsi_debug.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
index a922c8318a2f..deaed8b3e6c4 100644
--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -9053,6 +9053,8 @@ static void __exit scsi_debug_exit(void)
 
 	sdebug_erase_all_stores(false);
 	xa_destroy(per_store_ap);
+	/* Wait for deferred per-target debugfs cleanup before removing the root */
+	async_synchronize_full_domain(&sdebug_async_domain);
 	debugfs_remove(sdebug_debugfs_root);
 }
 
-- 
2.56.0