Re: 4.12 NULL pointer dereference in kmem_cache_free on USB storage removal

Path	csiph.com!news.redatomik.org!aioe.org!bofh.it!news.nic.it!robomod
From	Yagmur Oymak <yagmur.oymak@gmail.com>
Newsgroups	linux.kernel
Subject	Re: 4.12 NULL pointer dereference in kmem_cache_free on USB storage removal
Date	Wed, 19 Jul 2017 07:20:01 +0200
Message-ID	<u4PyV-3WT-3@gated-at.bofh.it> (permalink)
References	<u2SUi-1Tu-15@gated-at.bofh.it> <u2Tx1-2lO-27@gated-at.bofh.it>
Dkim-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-transfer-encoding:content-language; bh=hAeXqstbDDrg5VmelxyVvZWrCYBrFNt1lxrviR9NIg4=; b=ipj6iKuhQoPM7YvHZTlJAuo7A/9FtIg8tJFPgKVof3ko2g785UT42RXn94rwemrCb3 pPTo7jVN/2RWfkvZLix13PnIT0PdtDRTUIY5bJ/62t/TYu4ueHQsn0Duy/Witb5/6IxY RvHMwpyH36mKFFkaElBi7herF6wl8LkBgJfGFAI+pHVYosSyEpT5i6dB7+jpl3grMgWY n/520/5NzwOJkJjaje/WXjFRcgHbDIIJ/FeGkl0UPdDkAvESD0jaYw4dQFp9yB8BD2Ib QUjDfbkSkAdP1q31eHSvwFv+X093IlAWtUVUPfmDhERKOSMezvJL8sAFnXfYAwB/ClPp xV2Q==
X-Google-Dkim-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-transfer-encoding :content-language; bh=hAeXqstbDDrg5VmelxyVvZWrCYBrFNt1lxrviR9NIg4=; b=mdC72kYRG3N4ge9whNOWWBuQpnrmdopADlGh3chgu3DUS+f2M1Kt5SGDf1nsGnFP58 8Q7oOcoi6jZzvsOTng/zllAb72JSjp5CWm1PDM+YA30VUNaMJdFF6+rSnrtOBagc8Ssx Bf/V9DX3hyEFErl7qZLEP5+9+boSxE0kPnl3FypsSk8kwVyL2u3gsZknTq49mnHqxtjX i2cIlN12OvwNjJ4hjxxDfHGMRc1a614s5rgWrbOZZVYjR62vol2OuXWcgXnsW3qdptjB dMAYWIXnIvMYxLtqdOwjL6WYuoUNqrh2b7WAmgUIq0ZYkEW8GTCnccdPg/VgJYwlO/Fd FNsw==
X-Gm-Message-State	AIVw112DfuPDBUqPFYa1mO5dXRFuFiSxuChSVNx9EDLsH1o9sdqHhFHY J+RfQQG5s5WD1z16p1A=
X-Received	by 10.223.164.29 with SMTP id d29mr2836941wra.183.1500441216479; Tue, 18 Jul 2017 22:13:36 -0700 (PDT)
User-Agent	Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.2.0
MIME-Version	1.0
Content-Type	text/plain; charset=utf-8
Content-Transfer-Encoding	7bit
Content-Language	en-US
Sender	robomod@news.nic.it
List-ID	<linux-kernel.vger.kernel.org>
X-Mailing-List	linux-kernel@vger.kernel.org
Approved	robomod@news.nic.it
Lines	37
Organization	linux.* mail to news gateway
X-Original-Date	Wed, 19 Jul 2017 08:13:28 +0300
X-Original-Message-ID	<952856d9-5f6b-98db-98e3-6348d428e894@gmail.com>
X-Original-References	<alpine.LRH.2.20.1707132319290.24138@math.ut.ee> <1499980058.2740.22.camel@wdc.com>
X-Original-Sender	linux-kernel-owner@vger.kernel.org
Xref	csiph.com linux.kernel:1690972

Show key headers only | View raw

Hello,

That patch fixes the problem, as far as I tested. However, it still is
not included in stable by 4.12.2. The problem persists there, and is
fixed when this patch is applied on top of it. What to to about it?

Thanks,

Yagmur Oymak.


On 07/14/2017 12:07 AM, Bart Van Assche wrote:
> On Thu, 2017-07-13 at 23:24 +0300, Meelis Roos wrote:
>> [258062.320700] RIP: 0010:kmem_cache_free+0x12/0x160
>> [258062.320886] Call Trace:
>> [258062.320897]  scsi_exit_rq+0x4d/0x60
>> [258062.320909]  free_request_size+0x1c/0x30
>> [258062.320923]  mempool_destroy+0x1d/0x60
>> [258062.320935]  blk_exit_rl+0x1b/0x40
>> [258062.320946]  __blk_release_queue+0x7d/0x120
>> [258062.320959]  process_one_work+0x1af/0x340
>> [258062.320972]  worker_thread+0x43/0x3e0
>> [258062.320984]  kthread+0xfe/0x130
>> [258062.320995]  ? create_worker+0x170/0x170
>> [258062.321007]  ? kthread_create_on_node+0x40/0x40
>> [258062.321022]  ret_from_fork+0x22/0x30
> Hello Meelis,
>
> Thank you for your report. Can you apply commit 8e6882545d8c ("scsi: Avoid
> that scsi_exit_rq() triggers a use-after-free") on top of kernel v4.12 and
> retest? That commit has been tagged "Cc: stable" so I hope that this patch
> will be included in kernel v4.12.1. However, that kernel is not yet available
> unfortunately ...
>
> Thanks,
>
> Bart.

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Re: 4.12 NULL pointer dereference in kmem_cache_free on USB storage  removal Yagmur Oymak <yagmur.oymak@gmail.com> - 2017-07-19 07:20 +0200
  Re: 4.12 NULL pointer dereference in kmem_cache_free on USB storage  removal Bart Van Assche <Bart.VanAssche@wdc.com> - 2017-07-19 18:10 +0200

csiph-web