Re: [PATCH v2] scsi: sg: Avoid sg device teardown race

[Alexander Wetzel <alexander@xxxxxxxxxxxxxx>]

On 20.03.24 12:16, Greg KH wrote:
> On Wed, Mar 20, 2024 at 12:08:09PM +0100, Alexander Wetzel wrote:
> > sg_remove_sfp_usercontext() must not use sg_device_destroy() after
> > calling scsi_device_put().
> >
> > sg_device_destroy() is accessing the parent scsi device request_queue.
> > Which will already be set to NULL when the preceding call to
> > scsi_device_put() removed the last reference to the parent scsi device.
> >
> > The resulting NULL pointer exception will then crash the kernel.
> >
> > Link: https://lore.kernel.org/r/20240305150509.23896-1-Alexander@xxxxxxxxxxxxxx
> > Cc: <stable@xxxxxxxxxxxxxxx>
> > Signed-off-by: Alexander Wetzel <Alexander@xxxxxxxxxxxxxx>
> > ---
> > Changes compared to V1:
> > Reworked the commit message
>
> What commit id does this fix?

It's a combination of patches. I think
db59133e9279 ("scsi: sg: fix blktrace debugfs entries leakage") was the 
one which finally broke it.

The in the hindsight wrong sequence was introduced via:
c6517b7942fa ("[SCSI] sg: fix races during device removal")
and cc833acbee9d ("sg: O_EXCL and other lock handling")

Alexander