* [PATCH] ch: Make it again possible to open a ch device two or more times
@ 2019-10-09 17:35 Bart Van Assche
2019-10-10 3:40 ` Martin K. Petersen
0 siblings, 1 reply; 2+ messages in thread
From: Bart Van Assche @ 2019-10-09 17:35 UTC (permalink / raw)
To: Martin K . Petersen, James E . J . Bottomley
Cc: linux-scsi, Christoph Hellwig, Rob Turk, Bart Van Assche,
Hannes Reinecke, stable
Clearing ch->device in ch_release() is wrong because that pointer must
remain valid until ch_remove() is called. This patch fixes the following
crash the second time a ch device is opened:
BUG: kernel NULL pointer dereference, address: 0000000000000790
RIP: 0010:scsi_device_get+0x5/0x60
Call Trace:
ch_open+0x4c/0xa0 [ch]
chrdev_open+0xa2/0x1c0
do_dentry_open+0x13a/0x380
path_openat+0x591/0x1470
do_filp_open+0x91/0x100
do_sys_open+0x184/0x220
do_syscall_64+0x5f/0x1a0
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Reported-by: Rob Turk <robtu@rtist.nl>
Suggested-by: Rob Turk <robtu@rtist.nl>
Cc: Hannes Reinecke <hare@suse.de>
Cc: <stable@vger.kernel.org>
Fixes: 085e56766f74 ("scsi: ch: add refcounting")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
drivers/scsi/ch.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/scsi/ch.c b/drivers/scsi/ch.c
index 5f8153c37f77..76751d6c7f0d 100644
--- a/drivers/scsi/ch.c
+++ b/drivers/scsi/ch.c
@@ -579,7 +579,6 @@ ch_release(struct inode *inode, struct file *file)
scsi_changer *ch = file->private_data;
scsi_device_put(ch->device);
- ch->device = NULL;
file->private_data = NULL;
kref_put(&ch->ref, ch_destroy);
return 0;
--
2.23.0.581.g78d2f28ef7-goog
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] ch: Make it again possible to open a ch device two or more times
2019-10-09 17:35 [PATCH] ch: Make it again possible to open a ch device two or more times Bart Van Assche
@ 2019-10-10 3:40 ` Martin K. Petersen
0 siblings, 0 replies; 2+ messages in thread
From: Martin K. Petersen @ 2019-10-10 3:40 UTC (permalink / raw)
To: Bart Van Assche
Cc: Martin K . Petersen, James E . J . Bottomley, linux-scsi,
Christoph Hellwig, Rob Turk, Hannes Reinecke, stable
Bart,
> Clearing ch->device in ch_release() is wrong because that pointer must
> remain valid until ch_remove() is called. This patch fixes the
> following crash the second time a ch device is opened:
Applied to 5.4/scsi-fixes, thank you!
--
Martin K. Petersen Oracle Linux Engineering
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-10-10 3:40 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-10-09 17:35 [PATCH] ch: Make it again possible to open a ch device two or more times Bart Van Assche
2019-10-10 3:40 ` Martin K. Petersen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).