mirrors/scst
1
0
Fork 0
mirror of https://github.com/SCST-project/scst.git synced 2026-10-22 14:12:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

scst_mem: Acquire shared pool references only while alive

Browse Source 
Coccinelle api/atomic_as_refcounter.cocci reports:

  scst/src/scst_mem.c:1642:5-24:
  WARNING: atomic_dec_and_test variation before object free at line 1643.

Auditing this ownership counter exposes two bugs in shared pool lookup.
A lookup with a different owner mm returns the existing pool without
taking a reference. Its caller can then release another device's
ownership. Reject that lookup with NULL.

The last put can also reach zero before the destructor acquires
sgv_pools_mutex to unlink the pool. A concurrent lookup can still find
that pool. Use kref_get_unless_zero under the lookup mutex to reject a
pool whose destruction has already started.

Convert sgv_pool_ref to kref, retaining the existing nullable cleanup for
initialization failures separately from the last-reference callback.
The kref API also works on supported kernels predating refcount_t.

Add KUnit cases for same-mm acquisition, different-mm rejection and the
zero-reference state before unlinking. Export the private test header
in generated in-tree patches as well as the out-of-tree build.
This commit is contained in:
Gleb Chesnokov
2026-10-20 18:02:29 +03:00
parent 43ee1a7c5d
commit f175f5408f
6 changed files with 117 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/kernel/generate-kernel-patch
+2 -1
View File
@@ -325,7 +325,8 @@ scst_07_pres="scst/src/scst_pres.h scst/src/scst_pres.c"
scst_08_sysfs="scst/src/scst_sysfs.c \
scst/src/scst_sysfs_test.h"
scst_09_debug="scst/include/scst_debug.h scst/src/scst_debug.c"
scst_10_sgv="scst/include/scst_sgv.h scst/src/scst_mem.h scst/src/scst_mem.c doc/scst_pg.sgml"
scst_10_sgv="scst/include/scst_sgv.h scst/src/scst_mem.h scst/src/scst_mem.c \
scst/src/scst_mem_test.h doc/scst_pg.sgml"
scst_user="scst/include/scst_user.h scst/src/dev_handlers/scst_user_main.c \
scst/src/dev_handlers/scst_user_test.h"
scst_13_vdisk="scst/src/dev_handlers/scst_vdisk_main.c \