[PATCH] scsi: sg: fix memory-use-after-free on device removal

[Tony Battersby]

Fix memory-use-after-free race when closing a sg fd to a removed device.

Link: https://lore.kernel.org/linux-scsi/CAB7eexK_jr1LWOO9RWrBF9as7gAS9kpHjrZFRuRrRJF=1H4W6A@xxxxxxxxxxxxxx/
Reported-by: Rondreis <linhaoguo86@xxxxxxxxx>
Cc: <stable@xxxxxxxxxxxxxxx>
Signed-off-by: Tony Battersby <tonyb@xxxxxxxxxxxxxxx>
---
 drivers/scsi/sg.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index 340b050ad28d..f44cbe42dba9 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -388,6 +388,7 @@ sg_release(struct inode *inode, struct file *filp)
 		return -ENXIO;
 	SCSI_LOG_TIMEOUT(3, sg_printk(KERN_INFO, sdp, "sg_release\n"));
 
+	kref_get(&sdp->d_ref);
 	mutex_lock(&sdp->open_rel_lock);
 	scsi_autopm_put_device(sdp->device);
 	kref_put(&sfp->f_ref, sg_remove_sfp);
@@ -402,6 +403,7 @@ sg_release(struct inode *inode, struct file *filp)
 		wake_up_interruptible(&sdp->open_wait);
 	}
 	mutex_unlock(&sdp->open_rel_lock);
+	kref_put(&sdp->d_ref, sg_device_destroy);
 	return 0;
 }
 
-- 
2.25.1