Unverified Commit e945027f authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!3857 scsi: fix use-after-free problem in scsi_remove_target 

Merge Pull Request from: @ci-robot 
 
PR sync from: Li Nan <linan122@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/INCBNHCYHOLBGQZZFGD6K5TOQPFYUYZF/ 
 
https://gitee.com/openeuler/kernel/issues/I8UF7W 
 
Link:https://gitee.com/openeuler/kernel/pulls/3857

 

Reviewed-by: default avatarYu Kuai <yukuai3@huawei.com>
Reviewed-by: default avatarzhangyi (F) <yi.zhang@huawei.com>
Signed-off-by: default avatarZheng Zengkai <zhengzengkai@huawei.com>
parents d4a77630 698c20e2

drivers/scsi/scsi_sysfs.c

+10 −1
Original line number Diff line number Diff line
@@ -1623,7 +1623,16 @@ void scsi_remove_target(struct device *dev) 
		    starget->state == STARGET_CREATED_REMOVE)

			continue;

		if (starget->dev.parent == dev || &starget->dev == dev) {

			kref_get(&starget->reap_ref);

			/*

			 * If the reference count is already zero, skip

			 * this target. Calling kref_get_unless_zero() if

			 * the reference count is zero is safe because

			 * scsi_target_destroy() will wait until the host

			 * lock has been released before freeing starget.

			 */

			if (!kref_get_unless_zero(&starget->reap_ref))

				continue;



			if (starget->state == STARGET_CREATED)

				starget->state = STARGET_CREATED_REMOVE;

			else