Re: Tape device request_queue kref accounting bug causes slab corruption

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



From: Joe Lawrence <joe.lawrence@xxxxxxxxxxx>
Date: Fri, 14 Sep 2012 16:27:48 -0400
Subject: [PATCH] SCSI: st: Take additional queue ref in st_probe

The disk_release function expects that add_disk was called and that the
latter function took an extra reference to the disk queue.  The st driver
does not call add_disk, but when a tape device is torn down, the disk_type
release method disk_release is called, and we end up returning one too many
references.  Fix the kref accounting by adding a blk_get_queue to st_probe.

Signed-off-by: Joe Lawrence <joe.lawrence@xxxxxxxxxxx>
---
 drivers/scsi/st.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
index e41998c..e078944 100644
--- a/drivers/scsi/st.c
+++ b/drivers/scsi/st.c
@@ -4077,6 +4077,8 @@ static int st_probe(struct device *dev)
 	sprintf(disk->disk_name, "st%d", i);
 	disk->private_data = &tpnt->driver;
 	disk->queue = SDp->request_queue;
+	if (blk_get_queue(disk->queue)) /* disk_release expects extra kref */
+		goto out_put_queue;
 	tpnt->driver = &st_template;
 	scsi_tapes[i] = tpnt;
 	dev_num = i;
@@ -4208,6 +4210,8 @@ out_free_tape:
 	scsi_tapes[dev_num] = NULL;
 	st_nr_dev--;
 	write_unlock(&st_dev_arr_lock);
+out_put_queue:
+	blk_put_queue(disk->queue);
 out_put_disk:
 	put_disk(disk);
 	kfree(tpnt);
-- 
1.7.11.4


--
To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [SCSI Target Devel]     [Linux SCSI Target Infrastructure]     [Kernel Newbies]     [IDE]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux ATA RAID]     [Linux IIO]     [Samba]     [Device Mapper]
  Powered by Linux