Re: [REGRESSION v4.3] scsi_dh: use-after-free when removing scsi device

[Hannes Reinecke <hare@suse.de>]

On 09/30/2015 12:35 PM, Boaz Harrosh wrote:
> On 09/30/2015 12:28 PM, Hannes Reinecke wrote:
> <>
>> Pushing things into the background is typically not the best of
>> ideas; actually I've been running into issues with udev not being
>> complete by the time the next round is started. So more often than
>> not I would be greeted with messages:
>>
>> 'write: no such file or directory'
>>
>> when executing this line. Removing the '&' at the end made this
>> warning go away.
>>
>> And actually I'm not sure if the above script is a valid testcase;
> 
> So are you saying it is allowed to crash the Kernel with a crappy
> script?
> 
I'm just saying there might be race conditions lurking in the sysfs
code which just now came to light, without the patch being the
actual culprit.

>> from what I've seen there is no locking / reference counting when
>> accessing sysfs attributes. So as soon as you _can_ access the sysfs
>> attribute it is implicitly assumed to be valid.
>> In your case you will be _removing_ the sysfs attribute even though
>> it is still accessed, which of course will crash.
>>
> 
> Is that allowed? for usermode script to race and crash the Kernel?
> 
> From the original email it sounds like this used to be fine and it
> now crashes (with the &)
> 
Yeah, it is not meant to be as an excuse. Just an observation.
I still would like to see the results with my ALUA handler update;
there's a fair chance the issue is solved with that.

Cheers,

Hannes
-- 
Dr. Hannes Reinecke		               zSeries & Storage
hare@suse.de			               +49 911 74053 688
SUSE LINUX GmbH, Maxfeldstr. 5, 90409 Nürnberg
GF: F. Imendörffer, J. Smithard, J. Guild, D. Upmanyu, G. Norton
HRB 21284 (AG Nürnberg)
--
To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html