[PATCH v1] scsi: scsi_debug: Drain RCU callbacks before module exit

[Yibo Tan]

Replacing or removing a debugfs error-injection rule queues
sdebug_err_free() through call_rcu(). Device teardown also queues this
callback for every remaining rule. The callback resides in scsi_debug
module text, but scsi_debug_exit() does not wait for queued callbacks
before returning.

With lazy, offloaded RCU callbacks enabled, two runs replaced the same
error-injection rule 16 times and successfully unloaded scsi_debug.
Eleven seconds later rcuop/0 executed at the former module text base plus
0x1f0, the exact ELF offset of sdebug_err_free(), and hit the module
unload poison.

Call rcu_barrier() after teardown has stopped future callback submissions
so that all queued callbacks finish before the module text is released.
Two runs with the fix completed the 30-second post-unload observation
without an Oops, KASAN report, warning or panic.

The tested scsi_debug.c is byte-identical to the file in current mainline
and the current SCSI for-next branch.

A source reproducer, kernel configuration, complete serial logs and the
vulnerable/fixed result table are available at:

https://github.com/kimaiden1984-boop/linux-kernel-poc-collections/tree/main/cases/scsi-debug-rcu-callback-after-unload

Fixes: a9996d722b11 ("scsi: scsi_debug: Add interface to manage error injection for a single device")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: Codex:GPT-5
Signed-off-by: Yibo Tan <lhfff@xxxxxxxxxx>
---
 drivers/scsi/scsi_debug.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
index 3346562275f8..2fdb1cbe470b 100644
--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -8676,6 +8676,7 @@ static void __exit scsi_debug_exit(void)
 	sdebug_erase_all_stores(false);
 	xa_destroy(per_store_ap);
 	debugfs_remove(sdebug_debugfs_root);
+	rcu_barrier();
 }
 
 device_initcall(scsi_debug_init);
-- 
2.39.5