lkml.org 
[lkml]   [2010]   [Dec]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[15/44] libata: fix NULL sdev dereference race in atapi_qc_complete()
    2.6.27-stable review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Tejun Heo <tj@kernel.org>

    commit 2a5f07b5ec098edc69e05fdd2f35d3fbb1235723 upstream.

    SCSI commands may be issued between __scsi_add_device() and dev->sdev
    assignment, so it's unsafe for ata_qc_complete() to dereference
    dev->sdev->locked without checking whether it's NULL or not. Fix it.

    Signed-off-by: Tejun Heo <tj@kernel.org>
    Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    drivers/ata/libata-scsi.c | 5 ++++-
    1 file changed, 4 insertions(+), 1 deletion(-)

    --- a/drivers/ata/libata-scsi.c
    +++ b/drivers/ata/libata-scsi.c
    @@ -2371,8 +2371,11 @@ static void atapi_qc_complete(struct ata
    *
    * If door lock fails, always clear sdev->locked to
    * avoid this infinite loop.
    + *
    + * This may happen before SCSI scan is complete. Make
    + * sure qc->dev->sdev isn't NULL before dereferencing.
    */
    - if (qc->cdb[0] == ALLOW_MEDIUM_REMOVAL)
    + if (qc->cdb[0] == ALLOW_MEDIUM_REMOVAL && qc->dev->sdev)
    qc->dev->sdev->locked = 0;

    qc->scsicmd->result = SAM_STAT_CHECK_CONDITION;



    \
     
     \ /
      Last update: 2010-12-08 01:43    [W:0.020 / U:61.024 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site