scsi: st: Fix lock leak in st_ioctl()

[PATCH] scsi: st: Fix lock leak in st_ioctl()

Posted by Hongling Zeng 4 days, 15 hours ago

The default case in the switch statement returns directly from
st_common_ioctl() without releasing &STp->lock, causing a lock
imbalance. Fix by jumping to the out label to properly release
the lock.

Fixes: b37d70c0df85 ("scsi: st: Separate st-unique ioctl handling from SCSI common ioctl handling")
Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
---
 drivers/scsi/st.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
index f1c3c4946637..3b08992e1b10 100644
--- a/drivers/scsi/st.c
+++ b/drivers/scsi/st.c
@@ -3628,7 +3628,8 @@ static long st_ioctl(struct file *file, unsigned int cmd_in, unsigned long arg)
 	case MTIOCTOP:
 		break;
 	default:
-		return st_common_ioctl(STp, STm, file, cmd_in, arg);
+		retval = st_common_ioctl(STp, STm, file, cmd_in, arg);
+		goto out;
 	}
 
 	cmd_type = _IOC_TYPE(cmd_in);
-- 
2.25.1

Re: [PATCH] scsi: st: Fix lock leak in st_ioctl()

Posted by Hongling Zeng 4 days, 15 hours ago

   Hi,

   Please ignore my previous patch: [PATCH] scsi: st: Fix lock leak in 
st_ioctl()

   The original code is correct. st_common_ioctl() releases &STp->lock
   internally, so there is no lock leak. This is a false  positive.

   Sorry for the noise.

   Regards,
   Hongling

在 2026年05月20日 15:40, Hongling Zeng 写道:
> The default case in the switch statement returns directly from
> st_common_ioctl() without releasing &STp->lock, causing a lock
> imbalance. Fix by jumping to the out label to properly release
> the lock.
>
> Fixes: b37d70c0df85 ("scsi: st: Separate st-unique ioctl handling from SCSI common ioctl handling")
> Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
> ---
>   drivers/scsi/st.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
> index f1c3c4946637..3b08992e1b10 100644
> --- a/drivers/scsi/st.c
> +++ b/drivers/scsi/st.c
> @@ -3628,7 +3628,8 @@ static long st_ioctl(struct file *file, unsigned int cmd_in, unsigned long arg)
>   	case MTIOCTOP:
>   		break;
>   	default:
> -		return st_common_ioctl(STp, STm, file, cmd_in, arg);
> +		retval = st_common_ioctl(STp, STm, file, cmd_in, arg);
> +		goto out;
>   	}
>   
>   	cmd_type = _IOC_TYPE(cmd_in);

Re: [PATCH] scsi: st: Fix lock leak in st_ioctl()

Posted by Bart Van Assche 4 days, 7 hours ago

On 5/20/26 12:52 AM, Hongling Zeng wrote:
>    The original code is correct. st_common_ioctl() releases &STp->lock
>    internally, so there is no lock leak.
Indeed. See also the annotations in drivers/scsi/st.c in this patch 
series: "[PATCH 00/36] Enable lock context analysis for most SCSI drivers"
(https://lore.kernel.org/linux-scsi/20260312211636.3245119-1-bvanassche@acm.org/).

Bart.