4.12 NULL pointer dereference in kmem_cache_free on USB storage removal

4.12 NULL pointer dereference in kmem_cache_free on USB storage removal

[Yagmur Oymak]

Hello,

This problem was reported in the linux-kernel list, here:
https://lkml.org/lkml/2017/7/13/710, and it is said that commit
8e6882545d8c ("scsi: Avoid
that scsi_exit_rq() triggers a use-after-free") fixes it. It indeed
fixes it as the problem does not exist on 4.13-rc1 (which includes the
commit) and on 4.12.x if the patch is applied. However, none of the 4.12
releases since that discussion includes the patch, so the problem is
still there. Can that be included in the next stable release?

Thanks,
Yagmur Oymak

Re: 4.12 NULL pointer dereference in kmem_cache_free on USB storage removal

[Bart Van Assche]

On Sat, 2017-07-22 at 11:58 +0300, Yagmur Oymak wrote:
> This problem was reported in the linux-kernel list, here:
> https://lkml.org/lkml/2017/7/13/710, and it is said that commit
> 8e6882545d8c ("scsi: Avoid
> that scsi_exit_rq() triggers a use-after-free") fixes it. It indeed
> fixes it as the problem does not exist on 4.13-rc1 (which includes the
> commit) and on 4.12.x if the patch is applied. However, none of the 4.12
> releases since that discussion includes the patch, so the problem is
> still there. Can that be included in the next stable release?

(+Greg)

Hi Greg,

It seems to me like that commit has not been included in kernel v4.12.3?
Will it be included in a later stable v4.12.x kernel?

Thanks,

Bart.

Re: 4.12 NULL pointer dereference in kmem_cache_free on USB storage removal

[Bart Van Assche]

On Sun, 2017-07-23 at 03:08 +0000, Bart Van Assche wrote:
> On Sat, 2017-07-22 at 11:58 +0300, Yagmur Oymak wrote:
> > This problem was reported in the linux-kernel list, here:
> > https://lkml.org/lkml/2017/7/13/710, and it is said that commit
> > 8e6882545d8c ("scsi: Avoid
> > that scsi_exit_rq() triggers a use-after-free") fixes it. It indeed
> > fixes it as the problem does not exist on 4.13-rc1 (which includes the
> > commit) and on 4.12.x if the patch is applied. However, none of the 4.12
> > releases since that discussion includes the patch, so the problem is
> > still there. Can that be included in the next stable release?
> 
> (+Greg)
> 
> Hi Greg,
> 
> It seems to me like that commit has not been included in kernel v4.12.3?
> Will it be included in a later stable v4.12.x kernel?

(replying to my own e-mail)

According to this message a v4.12.x kernel that includes the aforementioned
commit will be released soon: https://www.spinics.net/lists/stable/msg182002.html.

Bart.