mirror of
https://github.com/SCST-project/scst.git
synced 2026-10-22 14:12:33 +00:00
Gleb Chesnokov
f175f5408f
Coccinelle api/atomic_as_refcounter.cocci reports: scst/src/scst_mem.c:1642:5-24: WARNING: atomic_dec_and_test variation before object free at line 1643. Auditing this ownership counter exposes two bugs in shared pool lookup. A lookup with a different owner mm returns the existing pool without taking a reference. Its caller can then release another device's ownership. Reject that lookup with NULL. The last put can also reach zero before the destructor acquires sgv_pools_mutex to unlink the pool. A concurrent lookup can still find that pool. Use kref_get_unless_zero under the lookup mutex to reject a pool whose destruction has already started. Convert sgv_pool_ref to kref, retaining the existing nullable cleanup for initialization failures separately from the last-reference callback. The kref API also works on supported kernels predating refcount_t. Add KUnit cases for same-mm acquisition, different-mm rejection and the zero-reference state before unlinking. Export the private test header in generated in-tree patches as well as the out-of-tree build.