Coccinelle api/atomic_as_refcounter.cocci reports:
scst/src/scst_mem.c:1642:5-24:
WARNING: atomic_dec_and_test variation before object free at line 1643.
Auditing this ownership counter exposes two bugs in shared pool lookup.
A lookup with a different owner mm returns the existing pool without
taking a reference. Its caller can then release another device's
ownership. Reject that lookup with NULL.
The last put can also reach zero before the destructor acquires
sgv_pools_mutex to unlink the pool. A concurrent lookup can still find
that pool. Use kref_get_unless_zero under the lookup mutex to reject a
pool whose destruction has already started.
Convert sgv_pool_ref to kref, retaining the existing nullable cleanup for
initialization failures separately from the last-reference callback.
The kref API also works on supported kernels predating refcount_t.
Add KUnit cases for same-mm acquisition, different-mm rejection and the
zero-reference state before unlinking. Export the private test header
in generated in-tree patches as well as the out-of-tree build.
The internal WRITE(32) generated for DIF type 2 has three defects:
put_unaligned() infers a one-byte store from its destination pointer,
reserved/control bytes retain stack data, and the application-tag mask
is copied from bytes 26 and 27 even for a 16-byte input CDB. This can
corrupt the protection information or make the backend reject the write.
Clear the complete output buffer, use a sized big-endian application-tag
store and obtain the mask through scst_cmd_get_dif_app_tag_mask(). That
helper reads an explicit WRITE SAME(32) mask or derives the short-command
mask from the application's tag-check setting.
Extract the existing CDB builder behind the private KUnit interface. Add
regression cases for distinct tag bytes, full output images, short and
long commands, both short-command mask modes and buffer boundaries.
Nonzero poison patterns expose missing stores and reads beyond the short
CDB. Include the private header in generated in-tree kernel patches.
Fixes: 906f4dfefb ("Merge t10-pi branch back")
Track upstream imports, compare driver snapshots, audit remaining
source differences and export patches mapped to the SCST tree. Keep
review artifacts outside Git and expose unresolved changes for review.
Move the newer QLogic kernel patch helpers into scripts/kernel with
their callers and tests. Add the update skill and guide, preserving
separate commits for upstream imports and SCST adaptations.
Move patch generation, specialization, regression, kernel selection and
module signing helpers together, with their shared shell libraries. Update
component Makefiles, CI, nightly jobs, packaging metadata, documentation
and KUnit tooling references alongside the move.
Adjust repository-root and source-inventory lookups for the deeper path.
Resolve rhel-rpm-functions relative to kernel-functions through
BASH_SOURCE, since it is also sourced by the QLogic extraction helpers.
Keep the regression runner behavior and the nightly kernel matrix intact,
including the existing checkpatch, sparse and smatch switches and policy.
Gleb Chesnokov