All of lore.kernel.org
 help / color / mirror / Atom feed
From: Tejun Heo <tj@kernel.org>
To: Mark Lord <kernel@teksavvy.com>
Cc: Jeff Garzik <jeff@garzik.org>,
	"linux-ide@vger.kernel.org" <linux-ide@vger.kernel.org>,
	stable <stable@kernel.org>,
	James Bottomley <James.Bottomley@HansenPartnership.com>
Subject: Re: [PATCH #upstream-fixes] libata: fix NULL sdev dereference race in atapi_qc_complete()
Date: Tue, 02 Nov 2010 22:56:46 +0100	[thread overview]
Message-ID: <4CD0891E.4010307@kernel.org> (raw)
In-Reply-To: <4CD0832A.3070503@teksavvy.com>

Hello, Mark.

On 11/02/2010 10:31 PM, Mark Lord wrote:
> On 10-11-01 06:39 AM, Tejun Heo wrote:
>> SCSI commands may be issued between __scsi_add_device() and dev->sdev
>> assignment, so it's unsafe for ata_qc_complete() to dereference
>> dev->sdev->locked without checking whether it's NULL or not.  Fix it.
>>
>> Signed-off-by: Tejun Heo<tj@kernel.org>
>> Cc: stable@kernel.org
> 
> Mmmm.. for some reason, this just screams "band-aid" to me,
> and makes me worry deeply about the underlaying race condition
> it all suggests..

Yeah, the coupling between sdev and ata_dev may look somewhat
band-aidy but AFAICS all others are explicitly checking whether
dev->sdev is set.  It's somewhat inevitable given the current probing
sequence (ATA dev comes up first and then tells SCSI to probe itself).

Thanks.

-- 
tejun

      reply	other threads:[~2010-11-02 21:54 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2010-11-01 10:39 [PATCH #upstream-fixes] libata: fix NULL sdev dereference race in atapi_qc_complete() Tejun Heo
2010-11-02 21:31 ` Mark Lord
2010-11-02 21:56   ` Tejun Heo [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=4CD0891E.4010307@kernel.org \
    --to=tj@kernel.org \
    --cc=James.Bottomley@HansenPartnership.com \
    --cc=jeff@garzik.org \
    --cc=kernel@teksavvy.com \
    --cc=linux-ide@vger.kernel.org \
    --cc=stable@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.