Re: [PATCH v2] Avoid that scsi_exit_rq() triggers a use-after-free

2017-05-04 Thread Scott Bauer
On Thu, May 04, 2017 at 03:32:44PM +, Bart Van Assche wrote: > On Thu, 2017-05-04 at 09:15 -0600, Scott Bauer wrote: > > On Thu, May 04, 2017 at 03:26:37PM +, Bart Van Assche wrote: > > > On Thu, 2017-05-04 at 09:30 +0200, Christoph Hellwig wrote: > > > > Please just add a flag to ->flags

Re: [PATCH v2] Avoid that scsi_exit_rq() triggers a use-after-free

2017-05-04 Thread Bart Van Assche
On Thu, 2017-05-04 at 09:15 -0600, Scott Bauer wrote: > On Thu, May 04, 2017 at 03:26:37PM +, Bart Van Assche wrote: > > On Thu, 2017-05-04 at 09:30 +0200, Christoph Hellwig wrote: > > > Please just add a flag to ->flags instead of adding a whole new field. > > > > > > Otherwise this looks

Re: [PATCH v2] Avoid that scsi_exit_rq() triggers a use-after-free

2017-05-04 Thread Scott Bauer
On Thu, May 04, 2017 at 03:26:37PM +, Bart Van Assche wrote: > On Thu, 2017-05-04 at 09:30 +0200, Christoph Hellwig wrote: > > Please just add a flag to ->flags instead of adding a whole new field. > > > > Otherwise this looks good to me. > > Hello Christoph, > > Thanks for the feedback. I

Re: [PATCH v2] Avoid that scsi_exit_rq() triggers a use-after-free

2017-05-04 Thread Bart Van Assche
On Thu, 2017-05-04 at 09:30 +0200, Christoph Hellwig wrote: > Please just add a flag to ->flags instead of adding a whole new field. > > Otherwise this looks good to me. Hello Christoph, Thanks for the feedback. I will make the proposed change and post a second version. Bart.

Re: [PATCH v2] Avoid that scsi_exit_rq() triggers a use-after-free

2017-05-04 Thread Christoph Hellwig
Please just add a flag to ->flags instead of adding a whole new field. Otherwise this looks good to me.

[PATCH v2] Avoid that scsi_exit_rq() triggers a use-after-free

2017-05-03 Thread Bart Van Assche
Dereferencing shost from scsi_exit_rq() is not safe because the SCSI host may already have been freed when scsi_exit_rq() is called. Increasing the shost reference count in scsi_init_rq() and dropping that reference in scsi_exit_rq() is nontrivial since scsi_host_dev_release() may sleep and since