Messages in this thread | | | Date | Sat, 04 Aug 2012 17:36:32 -0500 | From | Mike Christie <> | Subject | Re: [PATCH] fix NULL-pointer dereference on scsi_run_queue |
| |
On 08/04/2012 03:18 PM, Bart Van Assche wrote: > On 08/04/12 16:46, Mike Christie wrote: >> I think we have to have scsi-ml do a get_device when a sdev is added to >> the starved entry and then do a put_device when it is removed (must do >> these under the host lock for the starved entry case too). I am not sure >> if that is just a hack/papering-over of the problem and there are more >> issues like this. > > That would result in a more complex patch than the patch at the start of > this thread, isn't it ? Also, IMHO it would help to document which
Yaah, but the original patch in this thread is still racey isn't it?
spin_unlock(shost->host_lock);
The sdev/queue could get freed by some other thread when this function is right here, so the get_device call is now going to try to access freed memory.
+ /* hold a reference on the device so it doesn't release device */ + get_device(&sdev->sdev_gendev);
| |