From patchwork Wed May 3 18:09:11 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bart Van Assche X-Patchwork-Id: 9710241 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 5B75D60351 for ; Wed, 3 May 2017 18:09:25 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 4E4BD28673 for ; Wed, 3 May 2017 18:09:25 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 410892867C; Wed, 3 May 2017 18:09:25 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 6349628673 for ; Wed, 3 May 2017 18:09:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751391AbdECSJX (ORCPT ); Wed, 3 May 2017 14:09:23 -0400 Received: from esa1.hgst.iphmx.com ([68.232.141.245]:43140 "EHLO esa1.hgst.iphmx.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751354AbdECSJU (ORCPT ); Wed, 3 May 2017 14:09:20 -0400 X-IronPort-AV: E=Sophos;i="5.38,284,1491235200"; d="scan'208";a="117539393" Received: from mail-cys01nam02lp0052.outbound.protection.outlook.com (HELO NAM02-CY1-obe.outbound.protection.outlook.com) ([207.46.163.52]) by ob1.hgst.iphmx.com with ESMTP; 04 May 2017 02:09:19 +0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sharedspace.onmicrosoft.com; s=selector1-sharedspace-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=9JOy6gxSUyMSSU6on1yMRUqU7+EqyfYX1XwRfn8HuS8=; b=WWwrqegF1vnQVMKTa8Zx6GvKcyjqcccYmKATw9IO+z9AY4wOwzerohxcSdn5vdxjRCtnS4XZ1CLTsks6MroVL1zJIu/3JBrakwCNTGTYvo85bQ6wz5LLsNpkYeqCs0n17cKlLbaCffvCb1vbdg9KPTCKJ10J+cR4hmAETP7+yzg= Received: from CY4PR04CA0028.namprd04.prod.outlook.com (10.172.133.14) by BLUPR0401MB1540.namprd04.prod.outlook.com (10.163.83.158) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1047.13; Wed, 3 May 2017 18:09:17 +0000 Received: from CO1NAM04FT040.eop-NAM04.prod.protection.outlook.com (2a01:111:f400:7e4d::200) by CY4PR04CA0028.outlook.office365.com (2603:10b6:903:c6::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1061.12 via Frontend Transport; Wed, 3 May 2017 18:09:17 +0000 Authentication-Results: spf=pass (sender IP is 63.163.107.21) smtp.mailfrom=sandisk.com; lst.de; dkim=none (message not signed) header.d=none;lst.de; dmarc=bestguesspass action=none header.from=sandisk.com; Received-SPF: Pass (protection.outlook.com: domain of sandisk.com designates 63.163.107.21 as permitted sender) receiver=protection.outlook.com; client-ip=63.163.107.21; helo=milsmgep15.sandisk.com; Received: from milsmgep15.sandisk.com (63.163.107.21) by CO1NAM04FT040.mail.protection.outlook.com (10.152.91.23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.1047.9 via Frontend Transport; Wed, 3 May 2017 18:09:16 +0000 Received: from MILHUBIP03.sdcorp.global.sandisk.com (Unknown_Domain [10.201.67.162]) (using TLS with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by (Symantec Messaging Gateway) with SMTP id F7.36.29323.ACC1A095; Wed, 3 May 2017 11:09:16 -0700 (PDT) Received: from milsmgip11.sandisk.com (10.177.8.100) by MILHUBIP03.sdcorp.global.sandisk.com (10.177.9.96) with Microsoft SMTP Server id 14.3.319.2; Wed, 3 May 2017 11:09:14 -0700 X-AuditID: 0ac94369-1c3ff7000000728b-70-590a1cca2b16 Received: from exp-402881.sdcorp.global.sandisk.com ( [10.177.8.100]) by (Symantec Messaging Gateway) with SMTP id E6.31.11415.7CC1A095; Wed, 3 May 2017 11:09:13 -0700 (PDT) From: Bart Van Assche To: "Martin K . Petersen" , James Bottomley CC: , Bart Van Assche , Scott Bauer , "Christoph Hellwig" , Jan Kara , Hannes Reinecke , Subject: [PATCH v2] Avoid that scsi_exit_rq() triggers a use-after-free Date: Wed, 3 May 2017 11:09:11 -0700 Message-ID: <20170503180911.24326-1-bart.vanassche@sandisk.com> X-Mailer: git-send-email 2.12.2 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFnrELMWRmVeSWpSXmKPExsXCddJ5ke4ZGa5Ig3PLeSwWvNnLZrFy9VEm i9nTm5ksNvZzWHRf38Fmsfz4PyaLl/OusFss2PiI0YHDY9qkU2wei/e8ZPLYfbOBzePj01ss Huu3XGXxOLPgCLvH501yAexRXDYpqTmZZalF+nYJXBkPe3YwF3zTqnj96gZbA+NalS5GTg4J AROJbT0HmbsYuTiEBJYySfydu5QdwtnOKDHv2Vp2mKotre0sEInNjBJvPsxmAkmwCRhJfHs/ kwXEFhEolLi0rYMRpIhZ4C1Q944esCJhAXeJlkmrWEFsFgEViYOnrjOC2LwC9hL72t8yQmyQ lzi7ZSfYHRIC81glWvcdYIEoEpQ4OfMJmM0sICFx8MULZhBbSEBd4uSS+UwTGAVmISmbhaRs ASPTKkax3Myc4tz01AJDU73ixLyUzOJsveT83E2MkJDP3MF494n3IUYBDkYlHt4NdzkjhVgT y4orcw8xSnAwK4nw8nJwRQrxpiRWVqUW5ccXleakFh9ilOZgURLnPSczNUJIID2xJDU7NbUg tQgmy8TBKdXAOKtk4rWzar5p33b+0zjomvB4k+PJj7+bL+70Dvk3rb58ddzRN5YKMyb8eG8f V/E/I9uFM4VhQ+RT+2uv122f2W9gLVqbmvGJ/29dtxvnH9sHElo8wZWvdWxabXf3Hlx2ue/t 760bMg/+kvb4Y1zy73Ln68lNZX2+zW++WHJGr1oSpK8g86CISYmlOCPRUIu5qDgRAFc5pcl1 AgAA X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFlrPJMWRmVeSWpSXmKPExsXCtZEjRfeUDFekwVp+i4M/2xgtFrzZy2ax cvVRJovZ05uZLDb2c1h0X9/BZrH8+D8mi5fzrrBbLNj4iNGB02PapFNsHov3vGTy2H2zgc3j 49NbLB7T1pxn8li/5SqLx5kFR9g9Pm+SC+CI4rJJSc3JLEst0rdL4Mp42LODueCbVsXrVzfY GhjXqnQxcnJICJhIbGltZ+li5OIQEtjIKLFu+zV2kASbgJHEt/czWUBsEYFCifunT7OB2MwC 7xklzu/RA7GFBdwlWiatYgWxWQRUJU5/eQZWzytgL9HzcS8jxAJ5ibNbdjJPYORcwMiwilEs NzOnODc9s8DQUK84MS8lszhbLzk/dxMjOEg4I3cwPp1ofoiRiYNTqoFx3vPtwZuZd6Wfeqk0 YwZ7yrbldm8nPp3LMO0+W591VWrsRJU+4wTROrd+94u6U1PeyL56/HwJg8651RqXma9b6H+U OPLvdNC0D3dCpz1rZIrzEblkstfewH/OD4FdSntzny1R6bVWuv5ha8irNuv7PHfq/93UNxFq L9ueqc5xsTRK4Nlabeb/SizFGYmGWsxFxYkARBhMpcIBAAA= MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-Office365-Filtering-HT: Tenant X-Forefront-Antispam-Report: CIP:63.163.107.21; IPV:NLI; CTRY:US; EFV:NLI; SFV:NSPM; SFS:(10019020)(6009001)(39410400002)(39450400003)(39840400002)(39860400002)(39850400002)(39400400002)(2980300002)(438002)(189002)(199003)(9170700003)(1076002)(5660300001)(50986999)(305945005)(77096006)(356003)(50466002)(575784001)(508600001)(81166006)(86362001)(8936002)(50226002)(8676002)(48376002)(4326008)(33646002)(230783001)(54906002)(2906002)(38730400002)(53936002)(36756003)(189998001)(106466001)(5003940100001)(47776003); DIR:OUT; SFP:1102; SCL:1; SRVR:BLUPR0401MB1540; H:milsmgep15.sandisk.com; FPR:; SPF:Pass; MLV:sfv; MX:1; A:1; LANG:en; X-Microsoft-Exchange-Diagnostics: 1; CO1NAM04FT040; 1:hg1A15oZ2uxY3m7vmsz+P1KvBaWdSynQMKwYr1giO7l9t++Hvp0tqf/Lac/61tlr2zkW93RaUft+MhaVvUvEuJQFSWqCZFowapo52YzQwjzgJCjkq3sU9d0fUjPh11wUKCGBO28bLWjzKgWnXLrOZ5OfEnf5KuZ7EgLVjCr+csm2kDn3vzX2+Gk0e2JNR/bEKDGjzioFv9KlB0L4gYMsuN966umPxCXNDe+GWHiDCKjmMU7i+d4cbPitdWe8oJ6earMrMkk7PvcXst7N5RUrCPxAyEBazjaCyaCXajoE/PQ5QYCkxBNnLhSHMPmyw4fuDvLYL5PmdJ5xt7wtvKZcJu5t2pNFeG6WGsY2IFGJ6nMSj32juU9t5vCd2HUnmZyBfglYncJ4h7QSesBfiQXwDPET5a7y01H5oh5NWd+RShhqorp8Dxm+IHUnP44DGV7y0MWpDnjjNfreYKH65pV2+kzLZXyKEGkamqJBPDtL7+/ik7zJuoq1IgOG4atifko/ECDxpIv0U5igLUqkRXPVnD5fvLjabnC/BKoz55IvDt0WGIgl36oOuVK+BxP9YExuX+cH1y8dpU2fkvfRSlZnQQ== X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: aa6b2316-ed31-4441-504f-08d4924f8370 X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(8251501002)(2017030254075)(201703131423075)(201703031133081); SRVR:BLUPR0401MB1540; X-Microsoft-Exchange-Diagnostics: 1; BLUPR0401MB1540; 3:feDSRBUwHePAG7qlRfQf4Qit6r6J9Ah4qh7xx3l81Untpc+jnzja5Ik57S+gnfGpJPVrFDulNz83Upi1gF6NqORJPZdDzWIA4d3mzB+Q8JnP6PmLtW6eEaI3UpG86SILrIA+BfgxPdjMMKqD96JMYcTOTnqRnOVxN7X4/br3eB0f0WJzt3dgq428xgi56z09XhJ/0uG9jzBc/SOG2IMLSYa03+TfbhqOraH8MmkZtH9WUXrIP/tkmaD8eLBK4k91N5LabOYch/Ebz6FW7sOFFk3D8DF39q3vagix4Lhdmz0sboXKznP6yweo6Wpqt752w4f51Czw9QMnIvtL2fM2fl3v3uqgBLt1Z7vnYkK1HWh5pwe6pyN1NWx4mWkt+LYKBrGYOj736+zfL2iimSBU0gkASu0HbmGUqh7ZEQw6F9oGLyv6KLIY0wAsZG6+5To4SimVvbQbUX2A2/yqtNnyWVEzp8tckpHE+bLbf/RQBb/mjKv+uVmqSdmSr+qO73nC X-Microsoft-Exchange-Diagnostics: 1; BLUPR0401MB1540; 25:Q7WV/bhvlSVB0s0XlmDKROMWEu4xPz7V9nMFb09Rq+hprh16l2xf9QqBVCR0Z8mBiSFhVKgqLL24kamIV9KW6zSMZtbnVEknOa625S7C+LKSq2Lq8tdoFD8j17NHponvZ1gGaoLfgRxx7iFBQXhgYvSapXuxX/B0NBVcr79cv/JDn3kPvD0wVE0RAw1VdPOrQhRrdoh4ULYyZaLeDOSfDLupu1SSdIUMHZ+79NcAQTyfHT70TKGKkpiFtsPBqDgMZvnMmdL4vSfhdNA+s5dUZ/tCVokigoVOph8IodbI7B7HdeU4A67vYxQ0YimoiXQvjX1d2cIM7q8buUaMMXZl/uQKiy6qXw8qb19+F3t71I6deFucPpRzkcDedwHxRUBHwxvjGL28BPmX5FRZhX9JS2mAJ++iBC6uAqPqsg/eSmZr7EdTjBD6uxY8/ieMlP34HhT0AMH4zUTVgIB83/5f8g==; 31:AqJmdjvp+qrpDO51lGK55I5ahwmiXMOUOcOF/A6u6x706q3dLOnzAUUKkSHWua+p3yusp6m5zWmpX2KkgvL0p++XmXccpRlAfyL5PJgq91LE1UvxCrpqPdYYc1P5+PYoj4Jan4SmOJSPw1GQSqxO5zNOMKORMc5qmpsHUPYFwqXgzmOjsUdl746Pb9yHZWYSM80HM43hFVuaQPiSkyzFG47Jw3qKfyfwRC7T5brpZvDzBuSSMIfUGtAhctGZVYmi1jKt4qDrW7BPBmptDxyhkLe7y/4vYITPbEKhwOO8Mak= WDCIPOUTBOUND: EOP-TRUE X-Microsoft-Exchange-Diagnostics: 1; BLUPR0401MB1540; 20:nP45PE2PWz8Vx4I1FUE65jA8oiWG5ii43hhG99PXNZ90PZ8zsdC4utw0RRacQ/5RgjkofRtLLoLEly0u+IgA8UJDOhjz9ARQPz04Ahanm+reImxiaB2riqzY6h9svKTL+qFp2y5PqRzX8hsRMgxSSCA+hq+r93C69uU+qWsadgr8EloRVY84mxUMC+r1MdwXX52WrH+AMooJcJWaA7DFl979xbyY1Imwtm9kIseBN2+bVGYT/NAdDumyn7TQHoQvR4giJ1ZJoPqP2gk6DvjKU0efcuoIuUMRsGlujBdzfFrHSvm2J4vwjUMAVNTYO/fOn5Gac+OoMHjfD9Fq57fhIJdf5gpvhAg+JorXbC6YI/GYH0Ath0ONEV8hSRXL177cg4Q5jVcusi3tSAB/CS0marycqNiyAG8QHtnuyiz5i9KzhQpwr9LlMRZ3KGZngA6z+ZB7jxf0CqeI/3aIHRq6OUIM//A1tbO2z/yME56YJqka1j6OcMFZYYkuvUZjt9pS X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(9452136761055)(42932892334569)(228905959029699); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040450)(601004)(2401047)(8121501046)(5005006)(13018025)(13016025)(10201501046)(3002001)(93006095)(93004095)(6055026)(6041248)(20161123564025)(20161123560025)(20161123555025)(20161123562025)(201703131423075)(201702281528075)(201703061421075)(6072148); SRVR:BLUPR0401MB1540; BCL:0; PCL:0; RULEID:; SRVR:BLUPR0401MB1540; X-Microsoft-Exchange-Diagnostics: 1; BLUPR0401MB1540; 4:h6VfEiPW535jiwqYXOLhIHRG7DtYwMrtyhwdI44Qccpe+/bimL5YixrXEyD+efboFNB6F134AmKLTcVd4MJkxYmpNYZ0d3j8d09ANoLUgCKNsg6FCEDYJo92XuPf/wJo2hNhMQBMvlV33KkZ5al6fZX5DDvxsU5GKYOI8rNrw7l8PuGqddl1ETHtcNhMWItedp6jgPVDTvXyoN/ABSuNlJn5WQRkXZppHjLOE+e/gLyfNwdBKuyPMun33cw+NnvYIK85RJIFd+g2TTDZeognIGfVg0TeZOXlD+nHgpRc5EQ3BhCFSB+d2MpjntiwFkQVmhhJH1TbZOp9N56AWmxpVJ+un6nN0jI1lHNHQluLVQf844cH4nb3ye5rYZfcTAAj6w5h3r+fliOTgs4c3wKNWpfkZ4gSAqgC0dlELsOazAtOWIMjzwcA3OX0V1EcOMpb3qOQoEBu9AN94F8bxJIrV6HpFSiE/rpxwjngsmgFU+IoLuSWoClIcPpvZMvHefvlawu4TTGu/pdagqNtjG5YeldTXQCPn3hImlFM6ERm6VBeVvBf3Hgzl9bTw/qwlJ6GfIs0J7UBcwaIIG8QQrW+QckjR5p0xsaLulJyEOKTWrpBlpNGHTvYI0fU7zaLb5VqFDSvCLDiwUp0xf5ftIbfmQEylvMl4bD+M7SR/L6pe5yCFV1oinyjSTXX+8KdbWIjOGj65xQPpJy57bbL7AJFBQZctSSs6oqvrnrb0pL5tJONDSyzEbRy3ABAmuh9INWPIZeelQJ/6nH+Sy+Xr2fAUOegFLPITfPfRUpzyVJTnO8cP/7bD0BoPHtPADdFQf7iI7DQeUarRs3qlOBKWjQ6oD9QTZRWdctH8lJCbtVPHADKp4eDnS4VjRaEB3gQ5+3Q X-Forefront-PRVS: 029651C7A1 X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; BLUPR0401MB1540; 23:Lr+qCAuxUoYrfksueBaGklyeWygjwJA9KUoBPIa?= =?us-ascii?Q?z7ih+GrtLqWVOd60oBYa3DRM+mjM3aRrKcGtaUzZZ8NYveWoTZrdWstXWI/I?= =?us-ascii?Q?vzterzlrg+dikD0Eyvkb6ofcheVwkcLECSgmLder/xCbu6p6wG3eIxa3CF3t?= =?us-ascii?Q?umiKDUes/Yzv1mrbsdJoCYJSihOQHRn/nX2VkfQI5Er4grhli0KEBQ09U8lx?= =?us-ascii?Q?56+gFl9Nx41Scu6A2ch94Obr6GMnWS6GEhRhb5yR2wN8Qtb5O9o32GllK3Zu?= =?us-ascii?Q?EKit8O7/NHN3Ydxj/on8bcNg1VCP9TfbJah2lA4aJCsaLEYp8VBF5mUHQWd/?= =?us-ascii?Q?SOB31NoNBg/uH4fgXk/VTxVe5TCjXLLtcBkQEzZhE0UaULJAv2Bl/l8xCB/z?= =?us-ascii?Q?mqvhukk+TGpFYSbepI7r2VAdDs9HcqfaGO0Qi6MEjkA3GuSmjIDK9HbGDC7Y?= =?us-ascii?Q?24beFY9tb17K57xIykxOreIF1JZlsU+xuU4wg58BNWm7Wxzd3c9y0TAERrM7?= =?us-ascii?Q?G2Z01PGpFX+z5JQI0922ycL67oBwHADbxsvSIrHv2AdQskIZ0Zn8wLeAEoQu?= =?us-ascii?Q?p15yF58OmXDZgzZBX8uNsyqJofYj1tOLTnJjBOpa2uXyRa+aR/uIk80F4/Va?= =?us-ascii?Q?qhNwfJSg7UB+lJopr3Vg5Fn1qSyPXJyBKVynntQdMXnYIMN4/Ibz60MiE2Kn?= =?us-ascii?Q?Bx1S5YzjuwMCORFjfJteDu9COAmIFC4SGfYN/MYfZdegzXkroM05z1MMrwQP?= =?us-ascii?Q?ZFD4AqkjCULjwW5KSSAgl0OJoIZULV/QE8VENN/armDaVB2RD9W8HRv8+18z?= =?us-ascii?Q?4I6HzglNGxdHMsKFl6YwS0g1Yk988uJoHSDE2TKdOGo6TL8KDHZm2O6/SQp/?= =?us-ascii?Q?MLsw0uiDHe4GrqziCa0JVT2KZ6aJECRwqvyT+hF0fXOzXrelRPX/qfeacuQs?= =?us-ascii?Q?73G/H+oF/J+ftS/+zP+YBoT1h4T9DChX5+dqZrYBrLMspfhfVL+EX9mcLqwM?= =?us-ascii?Q?nro5oyVlPCxp6GJB+ERBa7kYA?= X-Microsoft-Exchange-Diagnostics: 1; BLUPR0401MB1540; 6:ZoS0+/NjCQtVmb3tFK0SYn32K/DTeSjbJ+u3AybpKEHf6AQ1N0BQdWCEpNtlWq+GJIKxZE9QEt/VrDz7qi9yUKHYR4SDzEAW/rFTxBJVdFB9wmfyF9Vzl/G7uJLVBrkHpbtKbSXY3QFHY00PiNsDkYxTJImeOLe1y9ycFoXO/KVzWVcWb5xEqKZgq24QDQSn0Jd9cs1SMrzu2LeejcL74eJ8alc/aTM1LzxDTfUArJqME9Ouz+bcbf0rVdtEgo+Isvlwv2NnNYNhNyGJGoZw1ZumVaTwWHOh8L5k3nV36yYIHG2Sbp/GV3CzUtmkv0UrN+KJUmzkvSez5ZzUzSg4uwFcnBH86BLe37io/1gvaw9khpo5tKx04v2vHPxOyzTpgqVa2ZwVc/IwmcmoKIkLuy2nkFLExOC8mTe+p9Vg0vhlpJuNAX9NdxzNCjPQNFOhNFGDcdoevFt5Fiwm4zucarxR+jGa3rVT4uTZ6zrf4YMP1XKreYot4XR2BOHKjqCkdIhJqNeDVLRGe9XSG/xlANH6qe1iLCco5lT9e54uAK4=; 5:VOjQHoMn2IGUaOpa0uRLA9DmgGPree+TzREcnr3cAs+1WWBsBlJiDvT0mUsCVLzFZWXriKoJk0CRtoJUGLl5u4tRt05s/03AWicVulPbq9fLW/d6mxFZX0fZurGhnxw+0Dz0DEPsy8hBLKpuSpGwLg==; 24:8agTgXdV3MkINbImIK34EEWcX62tdKtMlXFX7+k+muAHH4SS/RKGo077NaNWzuQeZj4HJJsDg+/5psBXYDFnNzuVoTuaMtTgg47secCBY7E= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1; BLUPR0401MB1540; 7:Mqi+gyjRQDOKsIwR+pKAKHCsNBC1TARKoMNL1RBB7qief72p4mpB4SM7nhcCC2Hx023ldvc/KigWV+69Mfz8xNwQBn0hkHQ9Dwdznr2u0Nn6dJvCg+72juZx2VnH72XMK/Vm1yCvCQsV35z2M2z6/lbV1nxIEqFrBc2Oxn5WQOFNJh/vaCNHOO8Z8HZVQSmJRsbSqUAB5XgaKkG49l9dFwwBqOSvnNz8FkZoqxJSQqXpQBIOIoGa44IFg49LrJaWZdEAWcf20+k0St7s808V0Mb0y78ZiNg18rNUOmdRYbdHdEx46AYPxi36gh/QPW62L/PFN6SkbJ40axQ1F/Glrg==; 20:qGYCR3WxGWojfcQvSpvwPOy/nC+8dTzcuIYPB0yj/n/NFRGSxF6eZFWpvKSFAipyXFBUbDQ0IIS0Q92kAz2nJlGL8p//fNSA1PWMDiSuYLPxyQXQlzt3kN8pXZJ70oICq8Mg57J7AAejR+XXUE59vVtCTfbj0oA0zHSpzW07GmA= X-OriginatorOrg: sandisk.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 03 May 2017 18:09:16.5861 (UTC) X-MS-Exchange-CrossTenant-Id: b61c8803-16f3-4c35-9b17-6f65f441df86 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=b61c8803-16f3-4c35-9b17-6f65f441df86; Ip=[63.163.107.21]; Helo=[milsmgep15.sandisk.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: BLUPR0401MB1540 Sender: linux-scsi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-scsi@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Dereferencing shost from scsi_exit_rq() is not safe because the SCSI host may already have been freed when scsi_exit_rq() is called. Increasing the shost reference count in scsi_init_rq() and dropping that reference in scsi_exit_rq() is nontrivial since scsi_host_dev_release() may sleep and since scsi_exit_rq() may be called from interrupt context. Since scsi_exit_rq() only needs a single bit from shost, copy that bit into struct scsi_cmnd. Reported-by: Scott Bauer Fixes: e9c787e65c0c ("scsi: allocate scsi_cmnd structures as part of struct request") Signed-off-by: Bart Van Assche Cc: Scott Bauer Cc: Christoph Hellwig Cc: Jan Kara Cc: Hannes Reinecke Cc: --- drivers/scsi/scsi_lib.c | 39 +++++++++++++++++++++------------------ include/scsi/scsi_cmnd.h | 1 + 2 files changed, 22 insertions(+), 18 deletions(-) diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c index 15c9fe766071..3a5a49e3274a 100644 --- a/drivers/scsi/scsi_lib.c +++ b/drivers/scsi/scsi_lib.c @@ -43,23 +43,23 @@ static struct kmem_cache *scsi_sense_isadma_cache; static DEFINE_MUTEX(scsi_sense_cache_mutex); static inline struct kmem_cache * -scsi_select_sense_cache(struct Scsi_Host *shost) +scsi_select_sense_cache(bool unchecked_isa_dma) { - return shost->unchecked_isa_dma ? - scsi_sense_isadma_cache : scsi_sense_cache; + return unchecked_isa_dma ? scsi_sense_isadma_cache : scsi_sense_cache; } -static void scsi_free_sense_buffer(struct Scsi_Host *shost, - unsigned char *sense_buffer) +static void scsi_free_sense_buffer(bool unchecked_isa_dma, + unsigned char *sense_buffer) { - kmem_cache_free(scsi_select_sense_cache(shost), sense_buffer); + kmem_cache_free(scsi_select_sense_cache(unchecked_isa_dma), + sense_buffer); } -static unsigned char *scsi_alloc_sense_buffer(struct Scsi_Host *shost, +static unsigned char *scsi_alloc_sense_buffer(bool unchecked_isa_dma, gfp_t gfp_mask, int numa_node) { - return kmem_cache_alloc_node(scsi_select_sense_cache(shost), gfp_mask, - numa_node); + return kmem_cache_alloc_node(scsi_select_sense_cache(unchecked_isa_dma), + gfp_mask, numa_node); } int scsi_init_sense_cache(struct Scsi_Host *shost) @@ -67,7 +67,7 @@ int scsi_init_sense_cache(struct Scsi_Host *shost) struct kmem_cache *cache; int ret = 0; - cache = scsi_select_sense_cache(shost); + cache = scsi_select_sense_cache(shost->unchecked_isa_dma); if (cache) return 0; @@ -2004,10 +2004,12 @@ static int scsi_init_request(void *data, struct request *rq, unsigned int numa_node) { struct Scsi_Host *shost = data; + const bool unchecked_isa_dma = shost->unchecked_isa_dma; struct scsi_cmnd *cmd = blk_mq_rq_to_pdu(rq); - cmd->sense_buffer = - scsi_alloc_sense_buffer(shost, GFP_KERNEL, numa_node); + cmd->unchecked_isa_dma = unchecked_isa_dma; + cmd->sense_buffer = scsi_alloc_sense_buffer(unchecked_isa_dma, + GFP_KERNEL, numa_node); if (!cmd->sense_buffer) return -ENOMEM; cmd->req.sense = cmd->sense_buffer; @@ -2017,10 +2019,9 @@ static int scsi_init_request(void *data, struct request *rq, static void scsi_exit_request(void *data, struct request *rq, unsigned int hctx_idx, unsigned int request_idx) { - struct Scsi_Host *shost = data; struct scsi_cmnd *cmd = blk_mq_rq_to_pdu(rq); - scsi_free_sense_buffer(shost, cmd->sense_buffer); + scsi_free_sense_buffer(cmd->unchecked_isa_dma, cmd->sense_buffer); } static int scsi_map_queues(struct blk_mq_tag_set *set) @@ -2093,11 +2094,14 @@ EXPORT_SYMBOL_GPL(__scsi_init_queue); static int scsi_init_rq(struct request_queue *q, struct request *rq, gfp_t gfp) { struct Scsi_Host *shost = q->rq_alloc_data; + const bool unchecked_isa_dma = shost->unchecked_isa_dma; struct scsi_cmnd *cmd = blk_mq_rq_to_pdu(rq); memset(cmd, 0, sizeof(*cmd)); - cmd->sense_buffer = scsi_alloc_sense_buffer(shost, gfp, NUMA_NO_NODE); + cmd->unchecked_isa_dma = unchecked_isa_dma; + cmd->sense_buffer = scsi_alloc_sense_buffer(unchecked_isa_dma, gfp, + NUMA_NO_NODE); if (!cmd->sense_buffer) goto fail; cmd->req.sense = cmd->sense_buffer; @@ -2111,19 +2115,18 @@ static int scsi_init_rq(struct request_queue *q, struct request *rq, gfp_t gfp) return 0; fail_free_sense: - scsi_free_sense_buffer(shost, cmd->sense_buffer); + scsi_free_sense_buffer(unchecked_isa_dma, cmd->sense_buffer); fail: return -ENOMEM; } static void scsi_exit_rq(struct request_queue *q, struct request *rq) { - struct Scsi_Host *shost = q->rq_alloc_data; struct scsi_cmnd *cmd = blk_mq_rq_to_pdu(rq); if (cmd->prot_sdb) kmem_cache_free(scsi_sdb_cache, cmd->prot_sdb); - scsi_free_sense_buffer(shost, cmd->sense_buffer); + scsi_free_sense_buffer(cmd->unchecked_isa_dma, cmd->sense_buffer); } struct request_queue *scsi_alloc_queue(struct scsi_device *sdev) diff --git a/include/scsi/scsi_cmnd.h b/include/scsi/scsi_cmnd.h index b379f93a2c48..9f1b5432c4c1 100644 --- a/include/scsi/scsi_cmnd.h +++ b/include/scsi/scsi_cmnd.h @@ -139,6 +139,7 @@ struct scsi_cmnd { int result; /* Status code from lower level driver */ int flags; /* Command flags */ + bool unchecked_isa_dma; unsigned char tag; /* SCSI-II queued command tag */ };