Re: [PATCH] scsi: sg: fix slab-use-after-free Read in sg_release

Bart Van Assche
2024-11-21T20:24:09Z

On 11/20/24 4:59 AM, Suraj Sonawane wrote:
> diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
> index f86be197f..457d54171 100644
> --- a/drivers/scsi/sg.c
> +++ b/drivers/scsi/sg.c
> @@ -393,7 +393,6 @@ sg_release(struct inode *inode, struct file *filp)
>
> mutex_lock(&sdp->open_rel_lock);
> scsi_autopm_put_device(sdp->device);
> - kref_put(&sfp->f_ref, sg_remove_sfp);
> sdp->open_cnt--;
>
> /* possibly many open()s waiting on exlude clearing, start many;
> @@ -405,6 +404,7 @@ sg_release(struct inode *inode, struct file *filp)
> wake_up_interruptible(&sdp->open_wait);
> }
> mutex_unlock(&sdp->open_rel_lock);
> + kref_put(&sfp->f_ref, sg_remove_sfp);
> return 0;
> }

Reviewed-by: Bart Van Assche <bvanassche@acm.org>