Commit 8df5fc04 authored by James Bottomley's avatar James Bottomley

[SCSI] bsg: fix oops on remove

If you do a modremove of any sas driver, you run into an oops on
shutdown when the host is removed (coming from the host bsg device).
The root cause seems to be that there's a use after free of the
bsg_class_device:  In bsg_kref_release_function, this is used (to do a
put_device(bcg->parent) after bcg->release has been called.  In sas (and
possibly many other things) bcd->release frees the queue which contains
the bsg_class_device, so we get a put_device on unreferenced memory.
Fix this by taking a copy of the pointer to the parent before releasing
bsg.
Acked-by: default avatarFUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: default avatarJames Bottomley <James.Bottomley@HansenPartnership.com>
parent 27898988
...@@ -709,11 +709,12 @@ static void bsg_kref_release_function(struct kref *kref) ...@@ -709,11 +709,12 @@ static void bsg_kref_release_function(struct kref *kref)
{ {
struct bsg_class_device *bcd = struct bsg_class_device *bcd =
container_of(kref, struct bsg_class_device, ref); container_of(kref, struct bsg_class_device, ref);
struct device *parent = bcd->parent;
if (bcd->release) if (bcd->release)
bcd->release(bcd->parent); bcd->release(bcd->parent);
put_device(bcd->parent); put_device(parent);
} }
static int bsg_put_device(struct bsg_device *bd) static int bsg_put_device(struct bsg_device *bd)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment