From: "Martin K. Petersen" <martin.petersen@oracle.com>
To: Damien Le Moal <damien.lemoal@opensource.wdc.com>
Cc: linux-scsi@vger.kernel.org,
"Martin K . Petersen" <martin.petersen@oracle.com>,
Sathya Prakash <sathya.prakash@broadcom.com>,
Sreekanth Reddy <sreekanth.reddy@broadcom.com>,
Suganath Prabu Subramani <suganath-prabu.subramani@broadcom.com>,
MPT-FusionLinux.pdl@broadcom.com
Subject: Re: [PATCH v2] scsi: mpt3sas: fix use after free in _scsih_expander_node_remove()
Date: Tue, 29 Mar 2022 22:56:25 -0400 [thread overview]
Message-ID: <yq1a6d8xi5w.fsf@ca-mkp.ca.oracle.com> (raw)
In-Reply-To: <20220322055702.95276-1-damien.lemoal@opensource.wdc.com> (Damien Le Moal's message of "Tue, 22 Mar 2022 14:57:02 +0900")
Damien,
> The function mpt3sas_transport_port_remove() called in
> _scsih_expander_node_remove() frees the port field of the sas_expander
> structure, leading to the following use-after-free splat from Kasan
> when the ioc_info() call following that function is executed
> (e.g. when doing rmmod of the driver module):
Applied to 5.18/scsi-staging, thanks!
--
Martin K. Petersen Oracle Linux Engineering
next prev parent reply other threads:[~2022-03-30 2:56 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-03-22 5:57 [PATCH v2] scsi: mpt3sas: fix use after free in _scsih_expander_node_remove() Damien Le Moal
2022-03-22 6:34 ` Sreekanth Reddy
2022-03-30 2:56 ` Martin K. Petersen [this message]
2022-04-07 13:35 ` Martin K. Petersen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=yq1a6d8xi5w.fsf@ca-mkp.ca.oracle.com \
--to=martin.petersen@oracle.com \
--cc=MPT-FusionLinux.pdl@broadcom.com \
--cc=damien.lemoal@opensource.wdc.com \
--cc=linux-scsi@vger.kernel.org \
--cc=sathya.prakash@broadcom.com \
--cc=sreekanth.reddy@broadcom.com \
--cc=suganath-prabu.subramani@broadcom.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.