Jason Wang <jasowang@xxxxxxxxxx> writes: > On 10/28/2013 04:01 PM, Asias He wrote: >> vqs are freed in virtscsi_freeze but the hotcpu_notifier is not >> unregistered. We will have a use-after-free usage when the notifier >> callback is called after virtscsi_freeze. >> >> Signed-off-by: Asias He <asias@xxxxxxxxxx> Please include a Fixes: line, especially if you want the CC: stable. Thanks, Rusty. >> --- >> drivers/scsi/virtio_scsi.c | 15 ++++++++++++++- >> 1 file changed, 14 insertions(+), 1 deletion(-) >> >> diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c >> index 74b88ef..b26f1a5 100644 >> --- a/drivers/scsi/virtio_scsi.c >> +++ b/drivers/scsi/virtio_scsi.c >> @@ -957,6 +957,10 @@ static void virtscsi_remove(struct virtio_device *vdev) >> #ifdef CONFIG_PM >> static int virtscsi_freeze(struct virtio_device *vdev) >> { >> + struct Scsi_Host *sh = virtio_scsi_host(vdev); >> + struct virtio_scsi *vscsi = shost_priv(sh); >> + >> + unregister_hotcpu_notifier(&vscsi->nb); >> virtscsi_remove_vqs(vdev); >> return 0; >> } >> @@ -965,8 +969,17 @@ static int virtscsi_restore(struct virtio_device *vdev) >> { >> struct Scsi_Host *sh = virtio_scsi_host(vdev); >> struct virtio_scsi *vscsi = shost_priv(sh); >> + int err; >> + >> + err = virtscsi_init(vdev, vscsi); >> + if (err) >> + return err; >> + >> + err = register_hotcpu_notifier(&vscsi->nb); >> + if (err) >> + vdev->config->del_vqs(vdev); >> >> - return virtscsi_init(vdev, vscsi); >> + return err; >> } >> #endif >> > > Ping. Rusty, could you please review and apply this patch? > > Thanks -- To unsubscribe from this list: send the line "unsubscribe linux-scsi" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html