• James Bottomley's avatar
    [SCSI] bsg: fix oops on remove · 8df5fc04
    James Bottomley authored
    If you do a modremove of any sas driver, you run into an oops on
    shutdown when the host is removed (coming from the host bsg device).
    The root cause seems to be that there's a use after free of the
    bsg_class_device:  In bsg_kref_release_function, this is used (to do a
    put_device(bcg->parent) after bcg->release has been called.  In sas (and
    possibly many other things) bcd->release frees the queue which contains
    the bsg_class_device, so we get a put_device on unreferenced memory.
    Fix this by taking a copy of the pointer to the parent before releasing
    bsg.
    Acked-by: default avatarFUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
    Signed-off-by: default avatarJames Bottomley <James.Bottomley@HansenPartnership.com>
    8df5fc04
bsg.c 23.1 KB