Commit 90449f2d authored by Bart Van Assche's avatar Bart Van Assche Committed by Martin K. Petersen
Browse files

scsi: sg: Do not sleep in atomic context 



sg_finish_rem_req() calls blk_rq_unmap_user(). The latter function may
sleep. Hence, call sg_finish_rem_req() with interrupts enabled instead
of disabled.

Reported-by: default avatar <syzbot+c01f8e6e73f20459912e@syzkaller.appspotmail.com>
Closes: https://lore.kernel.org/linux-scsi/691560c4.a70a0220.3124cb.001a.GAE@google.com/


Cc: Hannes Reinecke <hare@suse.de>
Cc: stable@vger.kernel.org
Fixes: 97d27b0d ("scsi: sg: close race condition in sg_remove_sfp_usercontext()")
Signed-off-by: default avatarBart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/20251113181643.1108973-1-bvanassche@acm.org


Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent e6965188

drivers/scsi/sg.c

+9 −1
Original line number Diff line number Diff line
@@ -2208,9 +2208,17 @@ sg_remove_sfp_usercontext(struct work_struct *work) 
	write_lock_irqsave(&sfp->rq_list_lock, iflags);

	while (!list_empty(&sfp->rq_list)) {

		srp = list_first_entry(&sfp->rq_list, Sg_request, entry);

		sg_finish_rem_req(srp);

		list_del(&srp->entry);

		write_unlock_irqrestore(&sfp->rq_list_lock, iflags);



		sg_finish_rem_req(srp);

		/*

		 * sg_rq_end_io() uses srp->parentfp. Hence, only clear

		 * srp->parentfp after blk_mq_free_request() has been called.

		 */

		srp->parentfp = NULL;



		write_lock_irqsave(&sfp->rq_list_lock, iflags);

	}

	write_unlock_irqrestore(&sfp->rq_list_lock, iflags);