From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752762AbdEPR4R (ORCPT ); Tue, 16 May 2017 13:56:17 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:35491 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1750932AbdEPR4M (ORCPT ); Tue, 16 May 2017 13:56:12 -0400 Date: Tue, 16 May 2017 19:56:03 +0200 From: Benjamin Block To: Dashi DS1 Cao Cc: "linux-scsi@vger.kernel.org" , "linux-kernel@vger.kernel.org" Subject: Re: A bug in scsi_alloc_target of drivers/scsi/scsi_scan.c References: <23B7B563BA4E9446B962B142C86EF24A02D029C9@CNMAILEX03.lenovo.com> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <23B7B563BA4E9446B962B142C86EF24A02D029C9@CNMAILEX03.lenovo.com> User-Agent: Mutt/1.7.1 (2016-10-04) X-TM-AS-GCONF: 00 x-cbid: 17051617-0012-0000-0000-0000052F4D15 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 17051617-0013-0000-0000-0000187FF18A Message-Id: <20170516175603.GB14268@bblock-ThinkPad-W530> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2017-05-16_05:,, signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1703280000 definitions=main-1705160141 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hello Dashi, On Tue, May 09, 2017 at 09:08:14AM +0000, Dashi DS1 Cao wrote: > When debugging a race condition in scsi_remove_target of 3.12, I ran into this possible bug within scsi_alloc_target. > When an existing "struct scsi_target" is found and used, the starget just got through kzmalloc should be freed, rather than dong a "put_device(dev)". But that is exactly what is done when put_device is called and the internal ref-count drops below 1. It will go through the kobj-core and end up in scsi_target_dev_release(). Also this specific code was changed in 12fb8c1574d7d in 2010, see the commit message there. Beste Grüße / Best regards, - Benjamin Block > > diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c > index 81d4151..96795d4 100644 > --- a/drivers/scsi/scsi_scan.c > +++ b/drivers/scsi/scsi_scan.c > @@ -483,7 +483,7 @@ static struct scsi_target *scsi_alloc_target(struct device *parent, > > spin_unlock_irqrestore(shost->host_lock, flags); > if (ref_got) { > - put_device(dev); > + kfree(starget); > return found_target; > } > /* > -- > > Dashi Cao > -- Linux on z Systems Development / IBM Systems & Technology Group IBM Deutschland Research & Development GmbH Vorsitz. AufsR.: Martina Koederitz / Geschäftsführung: Dirk Wittkopp Sitz der Gesellschaft: Böblingen / Registergericht: AmtsG Stuttgart, HRB 243294