https://github.com/torvalds/linux
Revision d6c73964f1e2a07f75057fb32ae46f6599036f93 authored by Anatoliy Glagolev on 13 June 2018, 21:38:51 UTC, committed by Jens Axboe on 15 June 2018, 14:15:37 UTC
The existing implementation allows races between bsg_unregister and
bsg_open paths. bsg_unregister and request_queue cleanup and deletion
may start and complete right after bsg_get_device (in bsg_open path)
retrieves bsg_class_device and releases the mutex. Then bsg_open path
touches freed memory of bsg_class_device and request_queue.

One possible fix is to hold the mutex all the way through bsg_get_device
instead of releasing it after bsg_class_device retrieval.

Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-Off-By: Anatoliy Glagolev <glagolig@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
1 parent be7f99c
History
Tip revision: d6c73964f1e2a07f75057fb32ae46f6599036f93 authored by Anatoliy Glagolev on 13 June 2018, 21:38:51 UTC
bsg: fix race of bsg_open and bsg_unregister
Tip revision: d6c7396
File Mode Size
Documentation
LICENSES
arch
block
certs
crypto
drivers
firmware
fs
include
init
ipc
kernel
lib
mm
net
samples
scripts
security
sound
tools
usr
virt
.clang-format -rw-r--r-- 12.8 KB
.cocciconfig -rw-r--r-- 59 bytes
.get_maintainer.ignore -rw-r--r-- 31 bytes
.gitattributes -rw-r--r-- 30 bytes
.gitignore -rw-r--r-- 1.5 KB
.mailmap -rw-r--r-- 9.3 KB
COPYING -rw-r--r-- 423 bytes
CREDITS -rw-r--r-- 96.3 KB
Kbuild -rw-r--r-- 2.2 KB
Kconfig -rw-r--r-- 321 bytes
MAINTAINERS -rw-r--r-- 447.9 KB
Makefile -rw-r--r-- 61.1 KB
README -rw-r--r-- 800 bytes

README

back to top