FAILED: patch "[PATCH] scsi: st: Fix use-after-free race between st_remove() and" failed to apply to 6.18-stable tree

FAILED: patch "[PATCH] scsi: st: Fix use-after-free race between st_remove() and" failed to apply to 6.18-stable tree

[gregkh]

The patch below does not apply to the 6.18-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.18.y
git checkout FETCH_HEAD
git cherry-pick -x 71caf7f84bd62a4bf91cc95abd2de690afb8d15f
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable@vger.kernel.org>' --in-reply-to '2026102128-conjoined-uncoiled-3c92@gregkh' --subject-prefix 'PATCH 6.18.y' 'HEAD^..'

Possible dependencies:



thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 71caf7f84bd62a4bf91cc95abd2de690afb8d15f Mon Sep 17 00:00:00 2001
From: Laurence Oberman <loberman@redhat.com>
Date: Tue, 13 Oct 2026 16:25:48 -0400
Subject: [PATCH] scsi: st: Fix use-after-free race between st_remove() and
 st_open()

st_remove() drops the probe reference on the scsi_tape with kref_put()
and only afterwards removes its index from st_index_idr. If that was the
last reference, scsi_tape_release() frees the structure while it is
still published in the idr.

scsi_tape_get(), called from st_open(), looks up the tape in
st_index_idr and takes a reference under st_ref_mutex and
st_index_lock. remove_cdevs() does not wait for opens that are already
past chrdev_open(), so an open that is blocked on st_ref_mutex while
st_remove() holds it can take the mutex as soon as st_remove() drops it,
find the freed tpnt in the idr and call kref_get() on it:

  BUG: KASAN: slab-use-after-free in st_open
  Write of size 4 ...
   st_open (drivers/scsi/st.c:254 drivers/scsi/st.c:1291)
   chrdev_open
  ...
  Freed by task ...:
   kfree
   st_remove (drivers/scsi/st.c:4512)

Remove the index from the idr before dropping the reference, all under
st_ref_mutex. A concurrent scsi_tape_get() now either runs first and
holds a valid reference that keeps the tape alive, or runs afterwards
and finds nothing, so st_open() fails with -ENXIO.

This restores the ordering st_remove() had before the conversion to
st_index_idr, where the tape was unpublished from scsi_tapes[] before
the final kref_put().

Fixes: 6c648d95a6af ("[SCSI] st: get rid of scsi_tapes array")
Cc: stable@vger.kernel.org
Reported-by: Dingisoul <dingiso.kernel@gmail.com>
Closes: https://lore.kernel.org/linux-scsi/20261007211520.1428497-1-dingiso.kernel@gmail.com/
Tested-by: Dingisoul <dingiso.kernel@gmail.com>
Signed-off-by: Laurence Oberman <loberman@redhat.com>
Link: https://patch.msgid.link/20261013202548.249628-1-loberman@redhat.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>

diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
index cab8aa73969c..a757646c8dc6 100644
--- a/drivers/scsi/st.c
+++ b/drivers/scsi/st.c
@@ -4515,11 +4515,11 @@ static void st_remove(struct scsi_device *SDp)
 	remove_cdevs(tpnt);
 
 	mutex_lock(&st_ref_mutex);
-	kref_put(&tpnt->kref, scsi_tape_release);
-	mutex_unlock(&st_ref_mutex);
 	spin_lock(&st_index_lock);
 	idr_remove(&st_index_idr, index);
 	spin_unlock(&st_index_lock);
+	kref_put(&tpnt->kref, scsi_tape_release);
+	mutex_unlock(&st_ref_mutex);
 }
 
 /**

Re: FAILED: patch "[PATCH] scsi: st: Fix use-after-free race between st_remove() and" failed to apply to 6.18-stable tree

[Laurence Oberman]

On Wed, 2026-10-21 at 16:44 +0200, gregkh@linuxfoundation.org wrote:
> 
> The patch below does not apply to the 6.18-stable tree.
> If someone wants it applied there, or to any other stable or longterm
> tree, then please email the backport, including the original git
> commit
> id to <stable@vger.kernel.org>.
> 
> To reproduce the conflict and resubmit, you may use the following
> commands:
> 
> git fetch
> https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ lin
> ux-6.18.y
> git checkout FETCH_HEAD
> git cherry-pick -x 71caf7f84bd62a4bf91cc95abd2de690afb8d15f
> # <resolve conflicts, build, test, etc.>
> git commit -s
> git send-email --to '<stable@vger.kernel.org>' --in-reply-to
> '2026102128-conjoined-uncoiled-3c92@gregkh' --subject-prefix 'PATCH
> 6.18.y' 'HEAD^..'
> 
> Possible dependencies:
> 
> 
> 
> thanks,
> 
> greg k-h
> 
> ------------------ original commit in Linus's tree ------------------
> 
> From 71caf7f84bd62a4bf91cc95abd2de690afb8d15f Mon Sep 17 00:00:00
> 2001
> From: Laurence Oberman <loberman@redhat.com>
> Date: Tue, 13 Oct 2026 16:25:48 -0400
> Subject: [PATCH] scsi: st: Fix use-after-free race between
> st_remove() and
>  st_open()
> 
> st_remove() drops the probe reference on the scsi_tape with
> kref_put()
> and only afterwards removes its index from st_index_idr. If that was
> the
> last reference, scsi_tape_release() frees the structure while it is
> still published in the idr.
> 
> scsi_tape_get(), called from st_open(), looks up the tape in
> st_index_idr and takes a reference under st_ref_mutex and
> st_index_lock. remove_cdevs() does not wait for opens that are
> already
> past chrdev_open(), so an open that is blocked on st_ref_mutex while
> st_remove() holds it can take the mutex as soon as st_remove() drops
> it,
> find the freed tpnt in the idr and call kref_get() on it:
> 
>   BUG: KASAN: slab-use-after-free in st_open
>   Write of size 4 ...
>    st_open (drivers/scsi/st.c:254 drivers/scsi/st.c:1291)
>    chrdev_open
>   ...
>   Freed by task ...:
>    kfree
>    st_remove (drivers/scsi/st.c:4512)
> 
> Remove the index from the idr before dropping the reference, all
> under
> st_ref_mutex. A concurrent scsi_tape_get() now either runs first and
> holds a valid reference that keeps the tape alive, or runs afterwards
> and finds nothing, so st_open() fails with -ENXIO.
> 
> This restores the ordering st_remove() had before the conversion to
> st_index_idr, where the tape was unpublished from scsi_tapes[] before
> the final kref_put().
> 
> Fixes: 6c648d95a6af ("[SCSI] st: get rid of scsi_tapes array")
> Cc: stable@vger.kernel.org
> Reported-by: Dingisoul <dingiso.kernel@gmail.com>
> Closes:
> https://lore.kernel.org/linux-scsi/20261007211520.1428497-1-dingiso.kernel@gmail.com/
> Tested-by: Dingisoul <dingiso.kernel@gmail.com>
> Signed-off-by: Laurence Oberman <loberman@redhat.com>
> Link:
> https://patch.msgid.link/20261013202548.249628-1-loberman@redhat.com
> Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
> 
> diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
> index cab8aa73969c..a757646c8dc6 100644
> --- a/drivers/scsi/st.c
> +++ b/drivers/scsi/st.c
> @@ -4515,11 +4515,11 @@ static void st_remove(struct scsi_device
> *SDp)
>  	remove_cdevs(tpnt);
>  
>  	mutex_lock(&st_ref_mutex);
> -	kref_put(&tpnt->kref, scsi_tape_release);
> -	mutex_unlock(&st_ref_mutex);
>  	spin_lock(&st_index_lock);
>  	idr_remove(&st_index_idr, index);
>  	spin_unlock(&st_index_lock);
> +	kref_put(&tpnt->kref, scsi_tape_release);
> +	mutex_unlock(&st_ref_mutex);
>  }
>  
>  /**

Thanks Greg, 

I see the issue so I will send fixes for each one in turn:

upstream converted st to the new scsi_driver probe/remove callbacks
after 6.18. Upstream’s st_remove() is void st_remove(struct scsi_device
*SDp) and ends at }. 
In 6.18 and earlier it’s still int st_remove(struct device *dev) and
ends with return 0; The hunk’s trailing context doesn’t match, so the
cherry-pick conflicts. The fix itself is identical: unpublish from the
idr before the final kref_put(), all under st_ref_mutex.

[PATCH 6.18.y] scsi: st: Fix use-after-free race between st_remove() and st_open()

[Laurence Oberman]

commit 71caf7f84bd62a4bf91cc95abd2de690afb8d15f upstream.

st_remove() drops the probe reference on the scsi_tape with kref_put()
and only afterwards removes its index from st_index_idr. If that was the
last reference, scsi_tape_release() frees the structure while it is
still published in the idr.

scsi_tape_get(), called from st_open(), looks up the tape in
st_index_idr and takes a reference under st_ref_mutex and
st_index_lock. remove_cdevs() does not wait for opens that are already
past chrdev_open(), so an open that is blocked on st_ref_mutex while
st_remove() holds it can take the mutex as soon as st_remove() drops it,
find the freed tpnt in the idr and call kref_get() on it:

  BUG: KASAN: slab-use-after-free in st_open
  Write of size 4 ...
   st_open (drivers/scsi/st.c:254 drivers/scsi/st.c:1291)
   chrdev_open
  ...
  Freed by task ...:
   kfree
   st_remove (drivers/scsi/st.c:4512)

Remove the index from the idr before dropping the reference, all under
st_ref_mutex. A concurrent scsi_tape_get() now either runs first and
holds a valid reference that keeps the tape alive, or runs afterwards
and finds nothing, so st_open() fails with -ENXIO.

This restores the ordering st_remove() had before the conversion to
st_index_idr, where the tape was unpublished from scsi_tapes[] before
the final kref_put().

Fixes: 6c648d95a6af ("[SCSI] st: get rid of scsi_tapes array")
Cc: stable@vger.kernel.org
Reported-by: Dingisoul <dingiso.kernel@gmail.com>
Closes: https://lore.kernel.org/linux-scsi/20261007211520.1428497-1-dingiso.kernel@gmail.com/
Tested-by: Dingisoul <dingiso.kernel@gmail.com>
Signed-off-by: Laurence Oberman <loberman@redhat.com>
Link: https://patch.msgid.link/20261013202548.249628-1-loberman@redhat.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
[ loberman: st_remove() still returns int in 6.18; context adjusted ]
Signed-off-by: Laurence Oberman <loberman@redhat.com>
---
 drivers/scsi/st.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
index 74a6830b7ed8..0fbc274f8fe8 100644
--- a/drivers/scsi/st.c
+++ b/drivers/scsi/st.c
@@ -4465,11 +4465,11 @@ static int st_remove(struct device *dev)
 	remove_cdevs(tpnt);
 
 	mutex_lock(&st_ref_mutex);
-	kref_put(&tpnt->kref, scsi_tape_release);
-	mutex_unlock(&st_ref_mutex);
 	spin_lock(&st_index_lock);
 	idr_remove(&st_index_idr, index);
 	spin_unlock(&st_index_lock);
+	kref_put(&tpnt->kref, scsi_tape_release);
+	mutex_unlock(&st_ref_mutex);
 	return 0;
 }
 
-- 
2.56.0