Re: [PATCH] scsi_host sysfs updates scsi-misc-2.5 [0/2]

James Bottomley
2003-05-12T21:37:45Z

On Mon, 2003-05-12 at 16:49, Mike Anderson wrote:
> I am seeing size-512 with my modified version of scsi_debug. I modified
> slab.c to store last user for this size and it indicates it was
> scsi_free_shost. I am looking at this now.

I found it: you have a use after free in the sysfs code:

scsi_host_put does put_device followed by class_device_put, but the
put_device will free the shost containing the class_device in it's
release, so the class_device_put touches a freed object.

The solution is just to reverse the order of the puts.

James