[ Sasha's backport helper bot ]
Hi,
The upstream commit SHA1 provided is correct: f10593ad9bc36921f623361c9e3dd96bd52d85ee
WARNING: Author mismatch between patch and upstream commit:
Backport author: alvalan9@xxxxxxxxxxx
Commit author: Suraj Sonawane<surajsonawane0215@xxxxxxxxx>
Status in newer kernel trees:
6.12.y | Present (different SHA1: 1f5e2f1ca587)
6.6.y | Present (different SHA1: 59b30afa5786)
6.1.y | Not found
Note: The patch differs from the upstream commit:
---
1: f10593ad9bc3 ! 1: 7c77aeeb186d scsi: sg: Fix slab-use-after-free read in sg_release()
@@ Metadata
## Commit message ##
scsi: sg: Fix slab-use-after-free read in sg_release()
+ commit f10593ad9bc36921f623361c9e3dd96bd52d85ee upstream.
+
Fix a use-after-free bug in sg_release(), detected by syzbot with KASAN:
BUG: KASAN: slab-use-after-free in lock_release+0x151/0xa30
@@ Commit message
Link: https://lore.kernel.org/r/20241120125944.88095-1-surajsonawane0215@xxxxxxxxx
Reviewed-by: Bart Van Assche <bvanassche@xxxxxxx>
Signed-off-by: Martin K. Petersen <martin.petersen@xxxxxxxxxx>
+ Signed-off-by: Alva Lan <alvalan9@xxxxxxxxxxx>
## drivers/scsi/sg.c ##
@@ drivers/scsi/sg.c: sg_release(struct inode *inode, struct file *filp)
- SCSI_LOG_TIMEOUT(3, sg_printk(KERN_INFO, sdp, "sg_release\n"));
mutex_lock(&sdp->open_rel_lock);
+ scsi_autopm_put_device(sdp->device);
- kref_put(&sfp->f_ref, sg_remove_sfp);
sdp->open_cnt--;
---
Results of testing on various branches:
| Branch | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-6.1.y | Success | Success |
