Re: [PATCH V2] scsi_debugfs: fix crash in scsi_show_rq()

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Tue, 2017-11-07 at 23:21 +0800, Ming Lei wrote:
> cmd->cmnd can be allocated/freed dynamically in case of T10_PI_TYPE2_PROTECTION,
> so we can't access it in scsi_show_rq() if 'SCpnt->cmnd != scsi_req(rq)->cmd',
> because this request can be freed any time.

That description is inaccurate. It is not allowed to free SCpnt->cmnd while
a command is being executed.

> diff --git a/drivers/scsi/scsi_debugfs.c b/drivers/scsi/scsi_debugfs.c
> index 5e9755008aed..7a50878446b4 100644
> --- a/drivers/scsi/scsi_debugfs.c
> +++ b/drivers/scsi/scsi_debugfs.c
> @@ -9,7 +9,10 @@ void scsi_show_rq(struct seq_file *m, struct request *rq)
>  	int msecs = jiffies_to_msecs(jiffies - cmd->jiffies_at_alloc);
>  	char buf[80];
>  
> -	__scsi_format_command(buf, sizeof(buf), cmd->cmnd, cmd->cmd_len);
> +	if (cmd->cmnd == scsi_req(rq)->cmd)
> +		__scsi_format_command(buf, sizeof(buf), cmd->cmnd, cmd->cmd_len);
> +	else
> +		strcpy(buf, "unknown");
>  	seq_printf(m, ", .cmd=%s, .retries=%d, allocated %d.%03d s ago", buf,
>  		   cmd->retries, msecs / 1000, msecs % 1000);
>  }

This change introduces a new bug, namely that "unknown" will appear in the
debugfs output if (cmd->cmnd != scsi_req(rq)->cmd). Have you considered to use
the test (cmd->cmnd != NULL) instead?

Additionally, if you really want to avoid that this code crashes if NULL is
assigned to cmd->cmnd you will have to use READ_ONCE(cmd->cmnd).

Bart.




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [SCSI Target Devel]     [Linux SCSI Target Infrastructure]     [Kernel Newbies]     [IDE]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux ATA RAID]     [Linux IIO]     [Samba]     [Device Mapper]

  Powered by Linux