On Fri, 2015-11-20 at 10:14 -0800, Linus Torvalds wrote: > [ I don't know if the original reporter ended up actually sending this > to the scsi list like Greg asked, so I'll forward it myself just in > case ] No, this is the first time we've seen this. > There seems to be a very old use-after-free in the scsi code (git > blame says the lines around this area are from 2005 and 2008) that > kasan reports. > > I've tried to clean up the formatting in the email a bit, but the > executive summary seems to be that this: > > drivers/scsi/scsi_scan.c, around line 1459: > > scsi_device_put(sdev); > if (scsi_device_created(sdev)) > > is just wrong, because the "scsi_device_put()" may be freeing the > sdev, so then doing "scsi_device_created(sdev)" after it is bogus. We can look at it, but the analysis shouldn't be correct. This device is the one we first used to issue the report lun scan. Either it's an existing device, or we created it specially for the purpose. If it's an existing one, that put just releases our reference, but the core still has one (there'd have to be a very unusual scan destroy race for the core to be releasing a reference to an object it was in process of scanning). If we create it, then it releases our reference taken in line 1331 but it's also not a final put because alloc has to be paired with remove. However, it should also be harmless to move the put to after the if() clause ... can we ask the reporter to check if that's the fix? James -- To unsubscribe from this list: send the line "unsubscribe linux-scsi" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
