| Message ID | 20210311064636.10522-1-lyl2019@mail.ustc.edu.cn (mailing list archive) |
|---|---|
| State | Accepted |
| Headers | show |
| Series | scsi: Fix a use after free in st_open | expand |
> On 11. Mar 2021, at 8.46, Lv Yunlong <lyl2019@mail.ustc.edu.cn> wrote: > > In st_open, if STp->in_use is true, STp will be freed by > scsi_tape_put(). However, STp is still used by DEBC_printk() > after. It is better to DEBC_printk() before scsi_tape_put(). > > Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn> Acked-by: Kai Mäkisara <kai.makisara@kolumbus.fi> > --- > drivers/scsi/st.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c > index 841ad2fc369a..9ca536aae784 100644 > --- a/drivers/scsi/st.c > +++ b/drivers/scsi/st.c > @@ -1269,8 +1269,8 @@ static int st_open(struct inode *inode, struct file *filp) > spin_lock(&st_use_lock); > if (STp->in_use) { > spin_unlock(&st_use_lock); > - scsi_tape_put(STp); > DEBC_printk(STp, "Device already in use.\n"); > + scsi_tape_put(STp); > return (-EBUSY); > } Potential problem only when debugging enabled, but should be fixed. Thanks, Kai
On Wed, 10 Mar 2021 22:46:36 -0800, Lv Yunlong wrote: > In st_open, if STp->in_use is true, STp will be freed by > scsi_tape_put(). However, STp is still used by DEBC_printk() > after. It is better to DEBC_printk() before scsi_tape_put(). Applied to 5.12/scsi-fixes, thanks! [1/1] scsi: Fix a use after free in st_open https://git.kernel.org/mkp/scsi/c/c8c165dea4c8
diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c index 841ad2fc369a..9ca536aae784 100644 --- a/drivers/scsi/st.c +++ b/drivers/scsi/st.c @@ -1269,8 +1269,8 @@ static int st_open(struct inode *inode, struct file *filp) spin_lock(&st_use_lock); if (STp->in_use) { spin_unlock(&st_use_lock); - scsi_tape_put(STp); DEBC_printk(STp, "Device already in use.\n"); + scsi_tape_put(STp); return (-EBUSY); }
In st_open, if STp->in_use is true, STp will be freed by scsi_tape_put(). However, STp is still used by DEBC_printk() after. It is better to DEBC_printk() before scsi_tape_put(). Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn> --- drivers/scsi/st.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)