Messages in this thread | | | Date | Tue, 19 Apr 2022 22:28:07 +0800 | From | Wenchao Hao <> | Subject | [Question] SCSI_EH: How does EH guarantee there is no UAF of scsi_cmnd if host reset failed |
| |
Hi all, I am wondered how does SCSI EH guarantee there is no UAF of scsi_cmnd if host reset failed. If host reset failed and eh_cmd_q of shost is not empty, these command in eh_cmd_q would be added to done_q in scsi_eh_offline_sdevs() and finished by scsi_eh_flush_done_q(). So these scsi_cmnd and it's related request would be freed.
While since host reset failed, we can not guarantee the LLDDs has cleared all references to these commands in eh_cmd_q. Is there any possibility that the LLDDs reference to these commands? If this happened, then a using after free issue would occur.
Waiting for your response.
| |