* Possible use after free in scsi_put_command()?
@ 2014-06-24 15:07 Maurizio Lombardi
2014-06-25 6:52 ` Bart Van Assche
0 siblings, 1 reply; 5+ messages in thread
From: Maurizio Lombardi @ 2014-06-24 15:07 UTC (permalink / raw)
To: hare; +Cc: linux-scsi
Hi Hannes,
I've a question regarding the asynchronous scsi abort handler,
look at the scsi_put_command() function:
void scsi_put_command(struct scsi_cmnd *cmd)
{
unsigned long flags;
[...]
cancel_delayed_work(&cmd->abort_work);
__scsi_put_command(cmd->device->host, cmd);
}
cancel_delayed_work() may return while the abort handler is still running,
the problem is that __scsi_put_command() frees the cmd pointer that
is still used by the abort handler.
Is it correct? Isn't safer to use cancel_delayed_work_sync() here?
Thanks,
Maurizio Lombardi
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: Possible use after free in scsi_put_command()?
2014-06-24 15:07 Possible use after free in scsi_put_command()? Maurizio Lombardi
@ 2014-06-25 6:52 ` Bart Van Assche
2014-06-25 7:03 ` Maurizio Lombardi
0 siblings, 1 reply; 5+ messages in thread
From: Bart Van Assche @ 2014-06-25 6:52 UTC (permalink / raw)
To: Maurizio Lombardi, hare; +Cc: linux-scsi
On 06/24/14 17:07, Maurizio Lombardi wrote:
> I've a question regarding the asynchronous scsi abort handler,
> look at the scsi_put_command() function:
>
> void scsi_put_command(struct scsi_cmnd *cmd)
> {
> unsigned long flags;
> [...]
> cancel_delayed_work(&cmd->abort_work);
> __scsi_put_command(cmd->device->host, cmd);
> }
>
> cancel_delayed_work() may return while the abort handler is still running,
> the problem is that __scsi_put_command() frees the cmd pointer that
> is still used by the abort handler.
>
> Is it correct? Isn't safer to use cancel_delayed_work_sync() here?
Hello Maurizio,
I agree that that cancel_delayed_work() call is confusing. Hence
"[PATCH] Remove two cancel_delayed_work() calls from the mid-layer"
(http://thread.gmane.org/gmane.linux.scsi/91027). Had you already
noticed that patch ?
Best regards,
Bart.
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: Possible use after free in scsi_put_command()?
2014-06-25 6:52 ` Bart Van Assche
@ 2014-06-25 7:03 ` Maurizio Lombardi
2014-06-25 7:45 ` Bart Van Assche
0 siblings, 1 reply; 5+ messages in thread
From: Maurizio Lombardi @ 2014-06-25 7:03 UTC (permalink / raw)
To: Bart Van Assche; +Cc: hare, linux-scsi
Hi Bart,
On 06/25/2014 08:52 AM, Bart Van Assche wrote:
> Hello Maurizio,
>
> I agree that that cancel_delayed_work() call is confusing. Hence
> "[PATCH] Remove two cancel_delayed_work() calls from the mid-layer"
> (http://thread.gmane.org/gmane.linux.scsi/91027). Had you already
> noticed that patch ?
>
No, I missed it, thanks for pointing it out to me.
Thanks,
Maurizio Lombardi
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: Possible use after free in scsi_put_command()?
2014-06-25 7:03 ` Maurizio Lombardi
@ 2014-06-25 7:45 ` Bart Van Assche
2014-06-25 9:01 ` Christoph Hellwig
0 siblings, 1 reply; 5+ messages in thread
From: Bart Van Assche @ 2014-06-25 7:45 UTC (permalink / raw)
To: James Bottomley, Christoph Hellwig
Cc: Maurizio Lombardi, Hannes Reinecke, linux-scsi
On 06/25/14 09:03, Maurizio Lombardi wrote:
> On 06/25/2014 08:52 AM, Bart Van Assche wrote:
>> I agree that that cancel_delayed_work() call is confusing. Hence
>> "[PATCH] Remove two cancel_delayed_work() calls from the mid-layer"
>> (http://thread.gmane.org/gmane.linux.scsi/91027). Had you already
>> noticed that patch ?
>
> No, I missed it, thanks for pointing it out to me.
Hello James and Christoph,
Is it correct that the patch mentioned above has not yet been queued up
? Has it already been decided in which kernel version that patch should
be included ?
Thanks,
Bart.
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: Possible use after free in scsi_put_command()?
2014-06-25 7:45 ` Bart Van Assche
@ 2014-06-25 9:01 ` Christoph Hellwig
0 siblings, 0 replies; 5+ messages in thread
From: Christoph Hellwig @ 2014-06-25 9:01 UTC (permalink / raw)
To: Bart Van Assche
Cc: James Bottomley, Christoph Hellwig, Maurizio Lombardi,
Hannes Reinecke, linux-scsi
On Wed, Jun 25, 2014 at 09:45:07AM +0200, Bart Van Assche wrote:
> Hello James and Christoph,
>
> Is it correct that the patch mentioned above has not yet been queued up
> ? Has it already been decided in which kernel version that patch should
> be included ?
I've got it in my local pending queue for 3.17. I'll push that one out
soon.
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2014-06-25 9:01 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2014-06-24 15:07 Possible use after free in scsi_put_command()? Maurizio Lombardi
2014-06-25 6:52 ` Bart Van Assche
2014-06-25 7:03 ` Maurizio Lombardi
2014-06-25 7:45 ` Bart Van Assche
2014-06-25 9:01 ` Christoph Hellwig
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.