Messages in this thread Patch in this message |  | | From | Dashi DS1 Cao <> | Subject | A bug in scsi_alloc_target of drivers/scsi/scsi_scan.c | Date | Tue, 9 May 2017 09:08:14 +0000 |
| |
When debugging a race condition in scsi_remove_target of 3.12, I ran into this possible bug within scsi_alloc_target. When an existing "struct scsi_target" is found and used, the starget just got through kzmalloc should be freed, rather than dong a "put_device(dev)".
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c index 81d4151..96795d4 100644 --- a/drivers/scsi/scsi_scan.c +++ b/drivers/scsi/scsi_scan.c @@ -483,7 +483,7 @@ static struct scsi_target *scsi_alloc_target(struct device *parent,
spin_unlock_irqrestore(shost->host_lock, flags); if (ref_got) { - put_device(dev); + kfree(starget); return found_target; } /* -- Dashi Cao
|  |