From 23695e41a1cac017edad2b38607f33678a31b877 Mon Sep 17 00:00:00 2001 From: Junichi Nomura Date: Tue, 6 Oct 2015 04:32:57 +0000 Subject: scsi_dh: fix use-after-free when removing scsi device The commit 1bab0de0274f ("dm-mpath, scsi_dh: don't let dm detach device handlers") removed reference counting of attached scsi device handler. As a result, handler data is freed immediately via scsi_dh->detach() in the context of scsi_remove_device() where activation request can be still in flight. This patch moves scsi_dh_handler_detach() to sdev releasing function, scsi_device_dev_release_usercontext(), at that point the device is already in quiesced state. Fixes: 1bab0de0274f ("dm-mpath, scsi_dh: don't let dm detach device handlers") Signed-off-by: Jun'ichi Nomura Acked-by: Christoph Hellwig Signed-off-by: James Bottomley --- drivers/scsi/scsi_priv.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'drivers/scsi/scsi_priv.h') diff --git a/drivers/scsi/scsi_priv.h b/drivers/scsi/scsi_priv.h index 644bb7339b55..4d01cdb1b348 100644 --- a/drivers/scsi/scsi_priv.h +++ b/drivers/scsi/scsi_priv.h @@ -173,9 +173,11 @@ extern struct async_domain scsi_sd_probe_domain; /* scsi_dh.c */ #ifdef CONFIG_SCSI_DH int scsi_dh_add_device(struct scsi_device *sdev); +void scsi_dh_release_device(struct scsi_device *sdev); void scsi_dh_remove_device(struct scsi_device *sdev); #else static inline int scsi_dh_add_device(struct scsi_device *sdev) { return 0; } +static inline void scsi_dh_release_device(struct scsi_device *sdev) { } static inline void scsi_dh_remove_device(struct scsi_device *sdev) { } #endif -- cgit v1.2.3-58-ga151