From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: Joern Engel <joern@logfs.org>
Cc: linux-kernel@vger.kernel.org,
"Nicholas A. Bellinger" <nab@linux-iscsi.org>,
target-devel <target-devel@vger.kernel.org>
Subject: Re: [PATCH 2/3] target: close target_put_sess_cmd() vs. core_tmr_abort_task() race v5
Date: Tue, 14 May 2013 15:04:51 -0400 [thread overview]
Message-ID: <20130514190451.GA2907@kroah.com> (raw)
In-Reply-To: <1368477007-25274-3-git-send-email-joern@logfs.org>
On Mon, May 13, 2013 at 04:30:06PM -0400, Joern Engel wrote:
> It is possible for one thread to to take se_sess->sess_cmd_lock in
> core_tmr_abort_task() before taking a reference count on
> se_cmd->cmd_kref, while another thread in target_put_sess_cmd() drops
> se_cmd->cmd_kref before taking se_sess->sess_cmd_lock.
>
> This introduces kref_put_spinlock_irqsave() and uses it in
> target_put_sess_cmd() to close the race window.
>
> Signed-off-by: Joern Engel <joern@logfs.org>
For the kref.h part, please feel free to add:
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
next prev parent reply other threads:[~2013-05-14 19:04 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-05-13 20:30 [PATCH 0/3] target: Fix two races leading to use-after-free Joern Engel
2013-05-13 20:30 ` [PATCH 1/3] target: removed unused transport_state flag Joern Engel
2013-05-13 20:30 ` [PATCH 2/3] target: close target_put_sess_cmd() vs. core_tmr_abort_task() race v5 Joern Engel
2013-05-13 23:02 ` Nicholas A. Bellinger
2013-05-14 19:04 ` Greg Kroah-Hartman [this message]
2013-05-15 3:07 ` Nicholas A. Bellinger
2013-05-13 20:30 ` [PATCH 3/3] target: simplify target_wait_for_sess_cmds() Joern Engel
2013-05-13 23:00 ` Nicholas A. Bellinger
2013-05-13 22:00 ` Jörn Engel
2013-05-14 3:08 ` Nicholas A. Bellinger
2013-05-14 16:29 ` Jörn Engel
2013-05-15 3:05 ` Nicholas A. Bellinger
2013-05-15 2:19 ` Jörn Engel
2013-05-15 6:05 ` Nicholas A. Bellinger
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20130514190451.GA2907@kroah.com \
--to=gregkh@linuxfoundation.org \
--cc=joern@logfs.org \
--cc=linux-kernel@vger.kernel.org \
--cc=nab@linux-iscsi.org \
--cc=target-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.