[SCSI] bsg: fix oops on remove
authorJames Bottomley <James.Bottomley@HansenPartnership.com>
Mon, 7 Jul 2008 20:50:01 +0000 (15:50 -0500)
committerJames Bottomley <James.Bottomley@HansenPartnership.com>
Sat, 12 Jul 2008 15:14:56 +0000 (10:14 -0500)
commit8df5fc042c8e7c08dc438c8198b62407ee1e91a0
tree87a068716da8f04421e7cb6e9652ced863a9381d
parent27898988174bb211fd962ea73b9c6dc09f888705
[SCSI] bsg: fix oops on remove

If you do a modremove of any sas driver, you run into an oops on
shutdown when the host is removed (coming from the host bsg device).
The root cause seems to be that there's a use after free of the
bsg_class_device:  In bsg_kref_release_function, this is used (to do a
put_device(bcg->parent) after bcg->release has been called.  In sas (and
possibly many other things) bcd->release frees the queue which contains
the bsg_class_device, so we get a put_device on unreferenced memory.
Fix this by taking a copy of the pointer to the parent before releasing
bsg.

Acked-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
block/bsg.c