Commit 017f2e37 authored by Nagendra Singh Tomar's avatar Nagendra Singh Tomar Committed by James Bottomley

[SCSI] sd: udev accessing an uninitialized scsi_disk field results in a crash

	sd_probe() calls class_device_add() even before initializing the
sdkp->device variable. class_device_add() eventually results in the user mode
udev program to be called. udev program can read the the allow_restart
attribute of the newly created scsi device. This is resulting in a crash as
the show function for allow_restart (i.e sd_show_allow_restart) returns the
attribute value by reading the sdkp->device->allow_restart variable. As the
sdkp->device is not initialized before calling the user mode hotplug helper,
this results in a crash.
	The patch below solves it by calling class_device_add() only after the
necessary fields in the scsi_disk structure are initialized properly.
Signed-off-by: default avatarNagendra Singh Tomar <nagendra_tomar@adaptec.com>
Signed-off-by: default avatarJames Bottomley <James.Bottomley@SteelEye.com>
parent 91614c05
...@@ -1647,16 +1647,6 @@ static int sd_probe(struct device *dev) ...@@ -1647,16 +1647,6 @@ static int sd_probe(struct device *dev)
if (error) if (error)
goto out_put; goto out_put;
class_device_initialize(&sdkp->cdev);
sdkp->cdev.dev = &sdp->sdev_gendev;
sdkp->cdev.class = &sd_disk_class;
strncpy(sdkp->cdev.class_id, sdp->sdev_gendev.bus_id, BUS_ID_SIZE);
if (class_device_add(&sdkp->cdev))
goto out_put;
get_device(&sdp->sdev_gendev);
sdkp->device = sdp; sdkp->device = sdp;
sdkp->driver = &sd_template; sdkp->driver = &sd_template;
sdkp->disk = gd; sdkp->disk = gd;
...@@ -1670,6 +1660,16 @@ static int sd_probe(struct device *dev) ...@@ -1670,6 +1660,16 @@ static int sd_probe(struct device *dev)
sdp->timeout = SD_MOD_TIMEOUT; sdp->timeout = SD_MOD_TIMEOUT;
} }
class_device_initialize(&sdkp->cdev);
sdkp->cdev.dev = &sdp->sdev_gendev;
sdkp->cdev.class = &sd_disk_class;
strncpy(sdkp->cdev.class_id, sdp->sdev_gendev.bus_id, BUS_ID_SIZE);
if (class_device_add(&sdkp->cdev))
goto out_put;
get_device(&sdp->sdev_gendev);
gd->major = sd_major((index & 0xf0) >> 4); gd->major = sd_major((index & 0xf0) >> 4);
gd->first_minor = ((index & 0xf) << 4) | (index & 0xfff00); gd->first_minor = ((index & 0xf) << 4) | (index & 0xfff00);
gd->minors = 16; gd->minors = 16;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment