[PATCH 0/2] scsi: fix scsi_debug module-exit panic and pseudo target leak

[Laurence Oberman <loberman@redhat.com>]

CKI reported a NULL pointer dereference in debugfs_remove() from
sdebug_tartget_cleanup_async() while blktests throtl/001 unloaded
scsi_debug on 7.4.0-rc1 (arm64). The bug is not arm64 specific. It
reproduces on x86_64 with KASAN as a slab-use-after-free of the
per-target debugfs dentry.

While fixing it, instrumenting target alloc/destroy in scsi_debug showed
a second, independent problem in the SCSI core: the pseudo SCSI device's
target is never destroyed, because scsi_get_pseudo_sdev() leaks a
reap_ref. With add_host=4 num_tgts=16, ->target_alloc() was called 68
times and ->target_destroy() only 64; the missing four were the
pseudo-device targets at id max_id. Any LLD that sets nr_reserved_cmds
leaks its pseudo target.

Patch 1 fixes the core leak. Patch 2 makes scsi_debug_exit() wait for
the deferred per-target debugfs cleanup before removing the debugfs
root and unloading. Patch 1 was found while testing patch 2, and
patch 2 was tested on top of it.

Testing (x86_64 VM, KASAN, 7.4.0-rc1): loop
"modprobe scsi_debug add_host=4 num_tgts=16; rmmod scsi_debug", with
an msleep(200) temporarily added to sdebug_tartget_cleanup_async() to
force the race window.
  - unpatched: KASAN slab-use-after-free / oops on the first rmmod
  - patch 1: 68 target_alloc / 68 target_destroy, pseudo targets
    destroyed during scsi_remove_host()
  - patches 1+2: 50 iterations clean with the msleep

I had assistatnce from LLM for both of these and ran a local sashiko
which was clean other than a pre-existing issue

Laurence Oberman (2):
  scsi: core: Fix target reap_ref leak in scsi_get_pseudo_sdev()
  scsi: scsi_debug: Wait for async target cleanup on module exit

 drivers/scsi/scsi_debug.c |  2 ++
 drivers/scsi/scsi_scan.c  | 15 ++++++++-------
 2 files changed, 10 insertions(+), 7 deletions(-)

-- 
2.43.0