On Wed, 2010-09-08 at 17:12 -0700, Linus Torvalds wrote:
> Hmm. No noise about this one.
>
> Jens, Fujita, James, any comments?
>
> On Mon, Aug 30, 2010 at 11:46 AM, Alexey Dobriyan <adobriyan@xxxxxxxxx> wrote:
> > Not much of a calltrace, it scrolled away because of hardlockup detector.
> > On the bright side, radeon KMS worked correctly and actually showed it.
> >
> > $ addr2line -e vmlinux ffffffff812d207b
> > drivers/scsi/scsi_lib.c:1015
> >
> > 1012 err_exit:
> > 1013 scsi_release_buffers(cmd);
> > 1014 scsi_put_command(cmd);
> > 1015 ===> cmd->request->special = NULL; <===
> > 1016 return error;
> > 1017 }
> > 1018 EXPORT_SYMBOL(scsi_init_io);
>
> I do have to say that it looks rather wrong that it accesses "cmd"
> after it has done the "scsi_put_command(cmd)" on it.
>
> I also note that that was introduced pretty recently by commit
> 610a63498f7 ("scsi: fix discard page leak"), merged during this merge
> window. That does look suspicious to me.
It's a use after free: The put actually frees the cmnd and then we use
it to get to the request. Most of the time nothing notices, but if you
have poison on free enabled, we may see the problem. The fix is just to
reverse the put and the set.
James
--
To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
