linux-kernel - [PATCH] drivers/scsi: possible double spin_lock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.64.0907181722060.26792@ask.diku.dk>
Date:	Sat, 18 Jul 2009 17:22:41 +0200 (CEST)
From:	Julia Lawall <julia@...u.dk>
To:	James.Bottomley@...senPartnership.com, linux-scsi@...r.kernel.org,
	linux-kernel@...r.kernel.org, kernel-janitors@...r.kernel.org
Subject: [PATCH] drivers/scsi: possible double spin_lock_irqsave

From: Julia Lawall <julia@...u.dk>

If both the test on rport and the call to get_device fail, then the lock is
already held.  The re-lock is thus moved up into the two branches.

On the other hand if kref_put should not be called with the lock held then
something else should be done.

The semantic match that finds this problem is as follows:
(http://www.emn.fr/x-info/coccinelle/)

// <smpl>
@@
expression lock1,lock2;
expression flags;
@@

*spin_lock_irqsave(lock1,flags)
... when != flags
*spin_lock_irqsave(lock2,flags)
// </smpl>

Signed-off-by: Julia Lawall <julia@...u.dk>

---
 drivers/scsi/ibmvscsi/ibmvfc.c      |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/drivers/scsi/ibmvscsi/ibmvfc.c b/drivers/scsi/ibmvscsi/ibmvfc.c
index 166d964..d2b88bd 100644
--- a/drivers/scsi/ibmvscsi/ibmvfc.c
+++ b/drivers/scsi/ibmvscsi/ibmvfc.c
@@ -4278,15 +4278,16 @@ static void ibmvfc_rport_add_thread(struct work_struct *work)
 				if (!rport) {
 					spin_unlock_irqrestore(vhost->host->host_lock, flags);
 					ibmvfc_tgt_add_rport(tgt);
+					spin_lock_irqsave(vhost->host->host_lock, flags);
 				} else if (get_device(&rport->dev)) {
 					spin_unlock_irqrestore(vhost->host->host_lock, flags);
 					tgt_dbg(tgt, "Setting rport roles\n");
 					fc_remote_port_rolechg(rport, tgt->ids.roles);
 					put_device(&rport->dev);
+					spin_lock_irqsave(vhost->host->host_lock, flags);
 				}
 
 				kref_put(&tgt->kref, ibmvfc_release_tgt);
-				spin_lock_irqsave(vhost->host->host_lock, flags);
 				break;
 			}
 		}
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/