Re: Memory corruption & SCSI in 2.6.15

[Linus Torvalds]

On Mon, 12 Dec 2005, Brian King wrote:
> 
> Please try the attached patch. There appears to be a double free going on
> in the scsi scan code. There is a direct call to scsi_free_queue and then
> the following put_device calls the release function, which also frees
> the queue.

Indeed, that looks pretty subtle. 

James: Brian's patch looks obviously correct to me (scsi_alloc_sdev() will 
have called scsi_sysfs_device_initialize() which will set up the release 
function to free the queue). 

This code has been like that forever, though, which makes me wonder. Can 
anybody see what has changed to make the bug trigger? Or is there 
something I'm missing?

		Linus
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/