mirror of
https://github.com/torvalds/linux.git
synced 2024-11-07 04:32:03 +00:00
8df5fc042c
If you do a modremove of any sas driver, you run into an oops on shutdown when the host is removed (coming from the host bsg device). The root cause seems to be that there's a use after free of the bsg_class_device: In bsg_kref_release_function, this is used (to do a put_device(bcg->parent) after bcg->release has been called. In sas (and possibly many other things) bcd->release frees the queue which contains the bsg_class_device, so we get a put_device on unreferenced memory. Fix this by taking a copy of the pointer to the parent before releasing bsg. Acked-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com> |
||
|---|---|---|
| .. | ||
| as-iosched.c | ||
| blk-barrier.c | ||
| blk-core.c | ||
| blk-exec.c | ||
| blk-ioc.c | ||
| blk-map.c | ||
| blk-merge.c | ||
| blk-settings.c | ||
| blk-sysfs.c | ||
| blk-tag.c | ||
| blk.h | ||
| blktrace.c | ||
| bsg.c | ||
| cfq-iosched.c | ||
| compat_ioctl.c | ||
| deadline-iosched.c | ||
| elevator.c | ||
| genhd.c | ||
| ioctl.c | ||
| Kconfig | ||
| Kconfig.iosched | ||
| Makefile | ||
| noop-iosched.c | ||
| scsi_ioctl.c | ||