diff options
| author | Bart Van Assche <bvanassche@acm.org> | 2019-10-09 10:35:36 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-10-29 09:19:50 +0100 |
| commit | e254d435925928d0741ca510fad82c81287f2c8a (patch) | |
| tree | 536bd75eec11892a6016008b07d4e544d1ccc0cc /drivers/scsi/ch.c | |
| parent | 0c6905197c5ba2bb481058a74c235394a4203e8a (diff) | |
| download | linux-stable-e254d435925928d0741ca510fad82c81287f2c8a.tar.gz linux-stable-e254d435925928d0741ca510fad82c81287f2c8a.tar.bz2 linux-stable-e254d435925928d0741ca510fad82c81287f2c8a.zip | |
scsi: ch: Make it possible to open a ch device multiple times again
commit 6a0990eaa768dfb7064f06777743acc6d392084b upstream.
Clearing ch->device in ch_release() is wrong because that pointer must
remain valid until ch_remove() is called. This patch fixes the following
crash the second time a ch device is opened:
BUG: kernel NULL pointer dereference, address: 0000000000000790
RIP: 0010:scsi_device_get+0x5/0x60
Call Trace:
ch_open+0x4c/0xa0 [ch]
chrdev_open+0xa2/0x1c0
do_dentry_open+0x13a/0x380
path_openat+0x591/0x1470
do_filp_open+0x91/0x100
do_sys_open+0x184/0x220
do_syscall_64+0x5f/0x1a0
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Fixes: 085e56766f74 ("scsi: ch: add refcounting")
Cc: Hannes Reinecke <hare@suse.de>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20191009173536.247889-1-bvanassche@acm.org
Reported-by: Rob Turk <robtu@rtist.nl>
Suggested-by: Rob Turk <robtu@rtist.nl>
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/scsi/ch.c')
| -rw-r--r-- | drivers/scsi/ch.c | 1 |
1 files changed, 0 insertions, 1 deletions
diff --git a/drivers/scsi/ch.c b/drivers/scsi/ch.c index 1c5051b1c125..9e287927b7f9 100644 --- a/drivers/scsi/ch.c +++ b/drivers/scsi/ch.c @@ -578,7 +578,6 @@ ch_release(struct inode *inode, struct file *file) scsi_changer *ch = file->private_data; scsi_device_put(ch->device); - ch->device = NULL; file->private_data = NULL; kref_put(&ch->ref, ch_destroy); return 0; |