Re: Possible use after free in scsi_put_command()?

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 06/24/14 17:07, Maurizio Lombardi wrote:
> I've a question regarding the asynchronous scsi abort handler,
> look at the scsi_put_command() function:
> 
> void scsi_put_command(struct scsi_cmnd *cmd)
> {
>         unsigned long flags;
> 	[...]
>         cancel_delayed_work(&cmd->abort_work);
>         __scsi_put_command(cmd->device->host, cmd);
> }
> 
> cancel_delayed_work() may return while the abort handler is still running,
> the problem is that __scsi_put_command() frees the cmd pointer that
> is still used by the abort handler.
> 
> Is it correct? Isn't safer to use cancel_delayed_work_sync() here?

Hello Maurizio,

I agree that that cancel_delayed_work() call is confusing. Hence
"[PATCH] Remove two cancel_delayed_work() calls from the mid-layer"
(http://thread.gmane.org/gmane.linux.scsi/91027). Had you already
noticed that patch ?

Best regards,

Bart.

--
To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [SCSI Target Devel]     [Linux SCSI Target Infrastructure]     [Kernel Newbies]     [IDE]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux ATA RAID]     [Linux IIO]     [Samba]     [Device Mapper]
  Powered by Linux