[Question] SCSI_EH: How does EH guarantee there is no UAF of scsi_cmnd if host reset failed

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi all, I am wondered how does SCSI EH guarantee there is no UAF of scsi_cmnd
if host reset failed. If host reset failed and eh_cmd_q of shost is not empty,
these command in eh_cmd_q would be added to done_q in scsi_eh_offline_sdevs()
and finished by scsi_eh_flush_done_q(). So these scsi_cmnd and it's related
request would be freed.

While since host reset failed, we can not guarantee the LLDDs has cleared all
references to these commands in eh_cmd_q. Is there any possibility that the
LLDDs reference to these commands? If this happened, then a using after free
issue would occur.

Waiting for your response.



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [SCSI Target Devel]     [Linux SCSI Target Infrastructure]     [Kernel Newbies]     [IDE]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux ATA RAID]     [Linux IIO]     [Samba]     [Device Mapper]

  Powered by Linux