Re: [PATCH] scsi: scsi_debug: Wait for async target cleanup on module exit

[Laurence Oberman <loberman@redhat.com>]

On Tue, 2026-11-03 at 14:32 -0500, Laurence Oberman wrote:
> sdebug_target_destroy() is called with the host lock held, so it
> defers
> removal of the per-target debugfs directory to
> sdebug_tartget_cleanup_async() on sdebug_async_domain.
> scsi_debug_exit() removes the hosts and then removes
> sdebug_debugfs_root without waiting for that work. The recursive
> removal of the root frees the per-target dentries, and a cleanup that
> runs afterwards calls debugfs_remove() on a stale dentry:
> 
>   BUG: KASAN: slab-use-after-free in _raw_spin_lock+0x2d/0x40
>   Workqueue: async async_run_entry_fn
>   Call Trace:
>    kasan_report+0x92/0xc0
>    _raw_spin_lock+0x2d/0x40
>    lockref_get+0x9/0x40
>    __simple_recursive_removal+0x35/0x570
>    debugfs_remove+0x40/0x60
>    sdebug_tartget_cleanup_async+0x43/0x60 [scsi_debug]
>    async_run_entry_fn+0x96/0x520
>    process_one_work+0x925/0x1910
>    worker_thread+0x567/0xcc0
>    kthread+0x355/0x450
>   Allocated by task 150:
>    __d_alloc+0x34/0x9e0
>    d_alloc+0x44/0x1d0
>    ...
>    debugfs_create_dir+0x18/0x3d0
>    sdebug_target_alloc
>    scsi_alloc_target+0x7c7/0xa70
> 
> followed by a NULL inode dereference in down_write() from
> __simple_recursive_removal(). CKI hit this running blktests
> throtl/001
> on arm64. The cleanup can also run after the module text has been
> freed.
> 
> Commit b402a0dce64a ("scsi: scsi_debug: Fix create target debugfs
> failure") drains sdebug_async_domain before creating a target. Do the
> same in scsi_debug_exit() just before removing the debugfs root,
> after
> the driver has been unregistered so that no host can still be bound
> and
> queue further cleanup work.
> 
> Fixes: f084fe52c640 ("scsi: scsi_debug: Add debugfs interface to fail
> target reset")
> Reported-by: Catalin Marinas <catalin.marinas@arm.com>
> Closes: https://lore.kernel.org/r/auja2VnJTp-ijxqu@arm.com
> Reported-by: CKI Project <cki-project@redhat.com>
> Closes:
> https://datawarehouse.cki-project.org/kcidb/checkouts/redhat:3017229113
> Signed-off-by: Laurence Oberman <loberman@redhat.com>
> ---
>  drivers/scsi/scsi_debug.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
> index a922c8318a2f..deaed8b3e6c4 100644
> --- a/drivers/scsi/scsi_debug.c
> +++ b/drivers/scsi/scsi_debug.c
> @@ -9053,6 +9053,8 @@ static void __exit scsi_debug_exit(void)
>  
>  	sdebug_erase_all_stores(false);
>  	xa_destroy(per_store_ap);
> +	/* Wait for deferred per-target debugfs cleanup before
> removing the root */
> +	async_synchronize_full_domain(&sdebug_async_domain);
>  	debugfs_remove(sdebug_debugfs_root);
>  }
>  
Please ignore, this went out without series numbering. Resent as [PATCH
2/2] in reply to the cover letter.