diff options
| author | Christoph Hellwig <hch@lst.de> | 2014-04-15 12:24:56 +0200 |
|---|---|---|
| committer | James Bottomley <JBottomley@Parallels.com> | 2014-04-21 07:57:22 -0700 |
| commit | 68c03d9193f55dad93036f439b94912c5003a173 (patch) | |
| tree | 86dfc9927fe8b45aed7be80ec589231c3573c835 /Documentation/io_ordering.txt | |
| parent | 5e012aad85f2ee31d7de5c21d63ccd2702d63db2 (diff) | |
| download | op-kernel-dev-68c03d9193f55dad93036f439b94912c5003a173.zip op-kernel-dev-68c03d9193f55dad93036f439b94912c5003a173.tar.gz | |
[SCSI] don't reference freed command in scsi_prep_return
Patch
commit 0479633686d370303e3430256ace4bd5f7f138dc
Author: Christoph Hellwig <hch@infradead.org>
Date: Thu Feb 20 14:20:55 2014 -0800
[SCSI] do not manipulate device reference counts in scsi_get/put_command
Introduced a use after free:I in the kill case of scsi_prep_return we have to
release our device reference, but we do this trying to reference the just
freed command. Use the local sdev pointer instead.
Fixes: 0479633686d370303e3430256ace4bd5f7f138dc
Reported-by: Joe Lawrence <joe.lawrence@stratus.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Diffstat (limited to 'Documentation/io_ordering.txt')
0 files changed, 0 insertions, 0 deletions
