Re: [PATCH V4] scsi_debugfs: fix crash in scsi_show_rq()

2017-12-05 Thread Ming Lei
On Wed, Nov 15, 2017 at 08:04:49PM +0800, Ming Lei wrote: > On Wed, Nov 15, 2017 at 07:28:00PM +0900, James Bottomley wrote: > > On Wed, 2017-11-15 at 18:09 +0800, Ming Lei wrote: > > > On Tue, Nov 14, 2017 at 10:14:52AM -0800, James Bottomley wrote: > > > > > > > > On Tue, 2017-11-14 at 08:55

Re: [PATCH V4] scsi_debugfs: fix crash in scsi_show_rq()

2017-11-15 Thread James Bottomley
On Wed, 2017-11-15 at 18:09 +0800, Ming Lei wrote: > On Tue, Nov 14, 2017 at 10:14:52AM -0800, James Bottomley wrote: > > > > On Tue, 2017-11-14 at 08:55 +0800, Ming Lei wrote: > > > > > > Hi James, > > > > > > On Mon, Nov 13, 2017 at 10:55:52AM -0800, James Bottomley wrote: > > > > > > > > >

Re: [PATCH V4] scsi_debugfs: fix crash in scsi_show_rq()

2017-11-15 Thread Ming Lei
On Tue, Nov 14, 2017 at 10:14:52AM -0800, James Bottomley wrote: > On Tue, 2017-11-14 at 08:55 +0800, Ming Lei wrote: > > Hi James, > > > > On Mon, Nov 13, 2017 at 10:55:52AM -0800, James Bottomley wrote: > > > > > > On Sat, 2017-11-11 at 10:43 +0800, Ming Lei wrote: > > > > > > > > So from

Re: [PATCH V4] scsi_debugfs: fix crash in scsi_show_rq()

2017-11-14 Thread James Bottomley
On Tue, 2017-11-14 at 08:55 +0800, Ming Lei wrote: > Hi James, > > On Mon, Nov 13, 2017 at 10:55:52AM -0800, James Bottomley wrote: > > > > On Sat, 2017-11-11 at 10:43 +0800, Ming Lei wrote: > > > > > > So from CPU1's review, cmd->cmnd is in a remote NUMA node, > > > __scsi_format_command() is

Re: [PATCH V4] scsi_debugfs: fix crash in scsi_show_rq()

2017-11-13 Thread Ming Lei
Hi James, On Mon, Nov 13, 2017 at 10:55:52AM -0800, James Bottomley wrote: > On Sat, 2017-11-11 at 10:43 +0800, Ming Lei wrote: > > On Fri, Nov 10, 2017 at 08:51:58AM -0800, James Bottomley wrote: > > > > > > On Fri, 2017-11-10 at 17:01 +0800, Ming Lei wrote: > > > > > > > > cmd->cmnd can be

Re: [PATCH V4] scsi_debugfs: fix crash in scsi_show_rq()

2017-11-13 Thread James Bottomley
On Sat, 2017-11-11 at 10:43 +0800, Ming Lei wrote: > On Fri, Nov 10, 2017 at 08:51:58AM -0800, James Bottomley wrote: > > > > On Fri, 2017-11-10 at 17:01 +0800, Ming Lei wrote: > > > > > > cmd->cmnd can be allocated/freed dynamically in case of > > > T10_PI_TYPE2_PROTECTION, so we should check

Re: [PATCH V4] scsi_debugfs: fix crash in scsi_show_rq()

2017-11-10 Thread Ming Lei
On Fri, Nov 10, 2017 at 08:51:58AM -0800, James Bottomley wrote: > On Fri, 2017-11-10 at 17:01 +0800, Ming Lei wrote: > > cmd->cmnd can be allocated/freed dynamically in case of > > T10_PI_TYPE2_PROTECTION, > > so we should check it in scsi_show_rq() because this request may have > > been freed

Re: [PATCH V4] scsi_debugfs: fix crash in scsi_show_rq()

2017-11-10 Thread James Bottomley
On Fri, 2017-11-10 at 17:01 +0800, Ming Lei wrote: > cmd->cmnd can be allocated/freed dynamically in case of > T10_PI_TYPE2_PROTECTION, > so we should check it in scsi_show_rq() because this request may have > been freed already here, and cmd->cmnd has been set as null. > > We choose to accept

[PATCH V4] scsi_debugfs: fix crash in scsi_show_rq()

2017-11-10 Thread Ming Lei
cmd->cmnd can be allocated/freed dynamically in case of T10_PI_TYPE2_PROTECTION, so we should check it in scsi_show_rq() because this request may have been freed already here, and cmd->cmnd has been set as null. We choose to accept read-after-free and dump request data as far as possible. This