Re: [PATCH] scsi_host sysfs updates scsi-misc-2.5 [0/2]

Mike Anderson
2003-05-12T22:00:06Z

James Bottomley [James.Bottomley@steeleye.com] wrote:
> On Mon, 2003-05-12 at 16:49, Mike Anderson wrote:
> > I am seeing size-512 with my modified version of scsi_debug. I modified
> > slab.c to store last user for this size and it indicates it was
> > scsi_free_shost. I am looking at this now.
>
> I found it: you have a use after free in the sysfs code:
>
> scsi_host_put does put_device followed by class_device_put, but the
> put_device will free the shost containing the class_device in it's
> release, so the class_device_put touches a freed object.
>
> The solution is just to reverse the order of the puts.

Thanks for finding this. This fixes my slab issue also.