* [PATCH] Close list corruption window in __scsi_iterate_devices
@ 2006-02-21 22:28 James Smart
2006-02-21 23:51 ` [Cancel][PATCH] " James Smart
0 siblings, 1 reply; 2+ messages in thread
From: James Smart @ 2006-02-21 22:28 UTC (permalink / raw)
To: linux-scsi
The existing code could allow the use of a list pointer that is
grabbed prior to the lock, changes while waiting for the lock, thus
is no longer valid while the lock is held.
-- james s
--- a/drivers/scsi/scsi.c 2006-02-06 06:01:12.000000000 -0500
+++ b/drivers/scsi/scsi.c.NEW 2006-02-21 17:30:31.000000000 -0500
@@ -1015,11 +1015,12 @@ EXPORT_SYMBOL(scsi_device_put);
struct scsi_device *__scsi_iterate_devices(struct Scsi_Host *shost,
struct scsi_device *prev)
{
- struct list_head *list = (prev ? &prev->siblings : &shost->__devices);
+ struct list_head *list;
struct scsi_device *next = NULL;
unsigned long flags;
spin_lock_irqsave(shost->host_lock, flags);
+ list = (prev ? &prev->siblings : &shost->__devices);
while (list->next != &shost->__devices) {
next = list_entry(list->next, struct scsi_device, siblings);
/* skip devices that we can't get a reference to */
^ permalink raw reply [flat|nested] 2+ messages in thread* [Cancel][PATCH] Close list corruption window in __scsi_iterate_devices
2006-02-21 22:28 [PATCH] Close list corruption window in __scsi_iterate_devices James Smart
@ 2006-02-21 23:51 ` James Smart
0 siblings, 0 replies; 2+ messages in thread
From: James Smart @ 2006-02-21 23:51 UTC (permalink / raw)
To: James.Smart; +Cc: linux-scsi
Sorry folks - cold medicine had me seeing things. Ignore this.
-- james s
James Smart wrote:
> The existing code could allow the use of a list pointer that is
> grabbed prior to the lock, changes while waiting for the lock, thus
> is no longer valid while the lock is held.
>
> -- james s
>
> --- a/drivers/scsi/scsi.c 2006-02-06 06:01:12.000000000 -0500
> +++ b/drivers/scsi/scsi.c.NEW 2006-02-21 17:30:31.000000000 -0500
> @@ -1015,11 +1015,12 @@ EXPORT_SYMBOL(scsi_device_put);
> struct scsi_device *__scsi_iterate_devices(struct Scsi_Host *shost,
> struct scsi_device *prev)
> {
> - struct list_head *list = (prev ? &prev->siblings : &shost->__devices);
> + struct list_head *list;
> struct scsi_device *next = NULL;
> unsigned long flags;
>
> spin_lock_irqsave(shost->host_lock, flags);
> + list = (prev ? &prev->siblings : &shost->__devices);
> while (list->next != &shost->__devices) {
> next = list_entry(list->next, struct scsi_device, siblings);
> /* skip devices that we can't get a reference to */
> -
> To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2006-02-21 23:52 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2006-02-21 22:28 [PATCH] Close list corruption window in __scsi_iterate_devices James Smart
2006-02-21 23:51 ` [Cancel][PATCH] " James Smart
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).