From 2610bf1d0a0e396f0e6281f6c7d8c92d8fb1cfe2 Mon Sep 17 00:00:00 2001 From: Bart Van Assche Date: Tue, 12 Jan 2010 08:52:08 +0000 Subject: [PATCH] Fixed a race condition (use-after-free) that could trigger a kernel bug report during module unloading. git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@1451 d57e44dd-8a1f-0410-8b47-8ef2f437770f --- srpt/src/ib_srpt.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/srpt/src/ib_srpt.c b/srpt/src/ib_srpt.c index b044e8fa2..0d89c2bae 100644 --- a/srpt/src/ib_srpt.c +++ b/srpt/src/ib_srpt.c @@ -1976,6 +1976,9 @@ static void srpt_free_req_ring(struct srpt_rdma_ch *ch) * - Must be called as a callback function via scst_unregister_session(). Never * call this function directly because doing so would trigger several race * conditions. + * - Do not access ch->sport or ch->sport->sdev in this function because the + * memory that was allocated for the sport and/or sdev data structures may + * already have been freed at the time this function is called. */ static void srpt_release_channel(struct scst_session *scst_sess) { @@ -1985,8 +1988,6 @@ static void srpt_release_channel(struct scst_session *scst_sess) ch = scst_sess_get_tgt_priv(scst_sess); BUG_ON(!ch); - WARN_ON(srpt_find_channel(ch->sport->sdev, ch->cm_id) == ch); - WARN_ON(atomic_read(&ch->state) != RDMA_CHANNEL_DISCONNECTING); TRACE_DBG("destroying cm_id %p", ch->cm_id);