Re: [PATCH #upstream-fixes] libata: fix NULL sdev dereference race in atapi_qc_complete()

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hello, Mark.

On 11/02/2010 10:31 PM, Mark Lord wrote:
> On 10-11-01 06:39 AM, Tejun Heo wrote:
>> SCSI commands may be issued between __scsi_add_device() and dev->sdev
>> assignment, so it's unsafe for ata_qc_complete() to dereference
>> dev->sdev->locked without checking whether it's NULL or not.  Fix it.
>>
>> Signed-off-by: Tejun Heo<tj@xxxxxxxxxx>
>> Cc: stable@xxxxxxxxxx
> 
> Mmmm.. for some reason, this just screams "band-aid" to me,
> and makes me worry deeply about the underlaying race condition
> it all suggests..

Yeah, the coupling between sdev and ata_dev may look somewhat
band-aidy but AFAICS all others are explicitly checking whether
dev->sdev is set.  It's somewhat inevitable given the current probing
sequence (ATA dev comes up first and then tells SCSI to probe itself).

Thanks.

-- 
tejun
--
To unsubscribe from this list: send the line "unsubscribe linux-ide" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Linux Filesystems]     [Linux SCSI]     [Linux RAID]     [Git]     [Kernel Newbies]     [Linux Newbie]     [Security]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Samba]     [Device Mapper]

  Powered by Linux