Duoming, > When executing SMP task failed, the smp_execute_task_sg() calls > del_timer() to delete the "slow_task->timer". However, if the timer > handler sas_task_internal_timedout() is running, the del_timer() in > smp_execute_task_sg() will not stop it and the UAF bug will happen. Applied to 6.1/scsi-staging, thanks! -- Martin K. Petersen Oracle Linux Engineering
