From: Tejun Heo <tj@kernel.org>
To: Jeff Garzik <jeff@garzik.org>,
"linux-ide@vger.kernel.org" <linux-ide@vger.kernel.org>,
stable <stable@kernel.org>
Subject: [PATCH #upstream-fixes] libata: fix NULL sdev dereference race in atapi_qc_complete()
Date: Mon, 01 Nov 2010 11:39:19 +0100 [thread overview]
Message-ID: <4CCE98D7.1030906@kernel.org> (raw)
SCSI commands may be issued between __scsi_add_device() and dev->sdev
assignment, so it's unsafe for ata_qc_complete() to dereference
dev->sdev->locked without checking whether it's NULL or not. Fix it.
Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: stable@kernel.org
---
I actually hit this race condition. Lucky me. :-)
Thanks.
drivers/ata/libata-scsi.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
Index: work/drivers/ata/libata-scsi.c
===================================================================
--- work.orig/drivers/ata/libata-scsi.c
+++ work/drivers/ata/libata-scsi.c
@@ -2552,8 +2552,11 @@ static void atapi_qc_complete(struct ata
*
* If door lock fails, always clear sdev->locked to
* avoid this infinite loop.
+ *
+ * This may happen before SCSI scan is complete. Make
+ * sure qc->dev->sdev isn't NULL before dereferencing.
*/
- if (qc->cdb[0] == ALLOW_MEDIUM_REMOVAL)
+ if (qc->cdb[0] == ALLOW_MEDIUM_REMOVAL && qc->dev->sdev)
qc->dev->sdev->locked = 0;
qc->scsicmd->result = SAM_STAT_CHECK_CONDITION;
next reply other threads:[~2010-11-01 10:39 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-11-01 10:39 Tejun Heo [this message]
2010-11-02 21:31 ` [PATCH #upstream-fixes] libata: fix NULL sdev dereference race in atapi_qc_complete() Mark Lord
2010-11-02 21:56 ` Tejun Heo
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4CCE98D7.1030906@kernel.org \
--to=tj@kernel.org \
--cc=jeff@garzik.org \
--cc=linux-ide@vger.kernel.org \
--cc=stable@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.