From 2f50ca3d46b4d5916874ba19612498c0a9c1f5f9 Mon Sep 17 00:00:00 2001 From: Bart Van Assche Date: Tue, 13 Oct 2026 15:10:02 -0700 Subject: [PATCH] scsi: scsi_debug: Fix a locking bug in resp_write_same() If fetch_to_dev_buffer() fails in resp_write_same(), the function jumps to 'out' without releasing the data write lock acquired earlier via sdeb_data_write_lock(). Jump to 'unlock' instead so that sdeb_data_write_unlock() is called on the error path. This bug has been discovered by building the scsi_debug driver with Clang and modified lock context annotations. The modified lock context annotations are available in patch "scsi: scsi_debug: Improve lock context annotations". Fixes: 84f3a3c01d70 ("scsi: scsi_debug: Atomic write support") Reviewed-by: Christoph Hellwig Reviewed-by: John Garry Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/271ea11d3bc147d950a89419181f0c3f5a1ebf3b.1791924924.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) --- drivers/scsi/scsi_debug.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c index e679df1993aa..44b4587b53c6 100644 --- a/drivers/scsi/scsi_debug.c +++ b/drivers/scsi/scsi_debug.c @@ -5455,7 +5455,7 @@ static int resp_write_same(struct scsi_cmnd *scp, u64 lba, u32 num, if (-1 == ret) { ret = DID_ERROR << 16; - goto out; + goto unlock; } else if (sdebug_verbose && !ndob && (ret < lb_size)) sdev_printk(KERN_INFO, scp->device, "%s: %s: lb size=%u, IO sent=%d bytes\n", @@ -5472,8 +5472,9 @@ static int resp_write_same(struct scsi_cmnd *scp, u64 lba, u32 num, /* If ZBC zone then bump its write pointer */ if (sdebug_dev_is_zoned(devip)) zbc_inc_wp(devip, lba, num); - sdeb_data_write_unlock(sip); ret = 0; +unlock: + sdeb_data_write_unlock(sip); out: if (meta_data_locked) sdeb_meta_write_unlock(sip);