From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932127AbbKCEwj (ORCPT ); Mon, 2 Nov 2015 23:52:39 -0500 Received: from userp1040.oracle.com ([156.151.31.81]:45986 "EHLO userp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751612AbbKCEwe (ORCPT ); Mon, 2 Nov 2015 23:52:34 -0500 To: Douglas Gilbert Cc: Calvin Owens , "James E.J. Bottomley" , linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org, kernel-team@fb.com Subject: Re: [PATCH] sg: Fix double-free when drives detach during SG_IO From: "Martin K. Petersen" Organization: Oracle Corporation References: <944215ec334c3c5b3af98210acf8f6479f5539c8.1445634103.git.calvinowens@fb.com> <5637CE3F.6020706@interlog.com> Date: Mon, 02 Nov 2015 23:52:23 -0500 In-Reply-To: <5637CE3F.6020706@interlog.com> (Douglas Gilbert's message of "Mon, 2 Nov 2015 21:57:35 +0100") Message-ID: User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.5 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-Source-IP: aserv0022.oracle.com [141.146.126.234] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org >>>>> "Doug" == Douglas Gilbert writes: >> In sg_common_write(), we free the block request and return -ENODEV if >> the device is detached in the middle of the SG_IO ioctl(). >> >> Unfortunately, sg_finish_rem_req() also tries to free srp->rq, so we >> end up freeing rq->cmd in the already free rq object, and then free >> the object itself out from under the current user. >> >> This ends up corrupting random memory via the list_head on the rq >> object. The most common crash trace I saw is this: >> Signed-off-by: Calvin Owens Doug> Acked-by: Douglas Gilbert Applied. -- Martin K. Petersen Oracle Linux Engineering