lkml.org 
[lkml]   [2010]   [Sep]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: 2.6.36-rc3: EIP is at scsi_init_io+...
From
Date
On Wed, 2010-09-08 at 17:12 -0700, Linus Torvalds wrote:
> Hmm. No noise about this one.
>
> Jens, Fujita, James, any comments?
>
> On Mon, Aug 30, 2010 at 11:46 AM, Alexey Dobriyan <adobriyan@gmail.com> wrote:
> > Not much of a calltrace, it scrolled away because of hardlockup detector.
> > On the bright side, radeon KMS worked correctly and actually showed it.
> >
> > $ addr2line -e vmlinux ffffffff812d207b
> > drivers/scsi/scsi_lib.c:1015
> >
> > 1012 err_exit:
> > 1013 scsi_release_buffers(cmd);
> > 1014 scsi_put_command(cmd);
> > 1015 ===> cmd->request->special = NULL; <===
> > 1016 return error;
> > 1017 }
> > 1018 EXPORT_SYMBOL(scsi_init_io);
>
> I do have to say that it looks rather wrong that it accesses "cmd"
> after it has done the "scsi_put_command(cmd)" on it.
>
> I also note that that was introduced pretty recently by commit
> 610a63498f7 ("scsi: fix discard page leak"), merged during this merge
> window. That does look suspicious to me.

It's a use after free: The put actually frees the cmnd and then we use
it to get to the request. Most of the time nothing notices, but if you
have poison on free enabled, we may see the problem. The fix is just to
reverse the put and the set.

James




\
 
 \ /
  Last update: 2010-09-09 14:49    [W:0.066 / U:0.396 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site