Re: [PATCH v2 1/3] scsi: sd: fix error handling in sd_probe() after large pool creation failure

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] Calling device_unregister() before put_disk() in the error path creates a use-after-free vulnerability during SCSI Error Handling.
--

--- Patch [1]: [PATCH v2 1/3] scsi: sd: fix error handling in sd_probe() after large pool creation failure ---
commit f2e6ec332a4785be7451dad3afaf04d9cb43c90c
Author: Yang Xiuwei <yangxiuwei@kylinos.cn>
scsi: sd: fix error handling in sd_probe() after large pool creation failure

This commit modifies the error handling path in sd_probe() when
sd_large_pool_create() fails. It replaces a goto with direct calls to
device_unregister() and put_disk() to prevent leaking sysfs entries and
freeing an already registered device.

> diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
> index 599e75f333343..d18693d390b2f 100644
> --- a/drivers/scsi/sd.c
> +++ b/drivers/scsi/sd.c
> @@ -4089,7 +4089,9 @@ static int sd_probe(struct scsi_device *sdp)
>  	if (sdp->sector_size > PAGE_SIZE) {
>  		if (sd_large_pool_create()) {
>  			error = -ENOMEM;
> -			goto out_free_index;
> +			device_unregister(&sdkp->disk_dev);
> +			put_disk(gd);

[Severity: Critical]
Does this ordering create a use-after-free window?

By calling device_unregister() before put_disk(), the sdkp structure is
synchronously freed, but the request queue disk pointer remains set until
put_disk() runs.

If an asynchronous SCSI command times out precisely in this window, could
the SCSI error handler dereference the freed pointer?

drivers/scsi/sd.c:sd_eh_reset() {
        struct scsi_disk *sdkp = scsi_disk(scsi_cmd_to_rq(scmd)->q->disk);

        /* New SCSI EH run, reset gate variable */
        sdkp->ignore_medium_access_errors = false;
        ...
}

Would it be safer to call put_disk() before device_unregister() to clear
the queue disk pointer and prevent this concurrent access?

> +			goto out;
>  		}
>  	}
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260707030333.22245-1-yangxiuwei@kylinos.cn?part=1