Re: [BUG] scsi: st: use-after-free race between st_remove() and st_open()/scsi_tape_get()

[Dingisoul <dingiso.kernel@gmail.com>]

Hi Laurence,

Applied your patch, rebuilt, and reran the original reproducer.
No KASAN report, no warnings, no panic across the whole run.

Looks good to me -- feel free to send it upstream.

Best,
Dingisoul

On your patch:
> Hello
>
> Please try this patch, let me know if it fixes this and I will send a
> follow up to finalize this fix.
>
>
> diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
> index f1c3c49466..d5b90bd1c6 100644
> --- a/drivers/scsi/st.c
> +++ b/drivers/scsi/st.c
> @@ -4509,11 +4509,11 @@ static void st_remove(struct scsi_device *SDp)
>  	remove_cdevs(tpnt);
>
>  	mutex_lock(&st_ref_mutex);
> -	kref_put(&tpnt->kref, scsi_tape_release);
> -	mutex_unlock(&st_ref_mutex);
>  	spin_lock(&st_index_lock);
>  	idr_remove(&st_index_idr, index);
>  	spin_unlock(&st_index_lock);
> +	kref_put(&tpnt->kref, scsi_tape_release);
> +	mutex_unlock(&st_ref_mutex);
>  }