diff options
| author | Christoph Hellwig <hch@lst.de> | 2014-04-15 12:24:56 +0200 |
|---|---|---|
| committer | James Bottomley <JBottomley@Parallels.com> | 2014-04-21 07:57:22 -0700 |
| commit | 68c03d9193f55dad93036f439b94912c5003a173 (patch) | |
| tree | 86dfc9927fe8b45aed7be80ec589231c3573c835 /drivers/scsi | |
| parent | 5e012aad85f2ee31d7de5c21d63ccd2702d63db2 (diff) | |
| download | op-kernel-dev-68c03d9193f55dad93036f439b94912c5003a173.zip op-kernel-dev-68c03d9193f55dad93036f439b94912c5003a173.tar.gz | |
[SCSI] don't reference freed command in scsi_prep_return
Patch
commit 0479633686d370303e3430256ace4bd5f7f138dc
Author: Christoph Hellwig <hch@infradead.org>
Date: Thu Feb 20 14:20:55 2014 -0800
[SCSI] do not manipulate device reference counts in scsi_get/put_command
Introduced a use after free:I in the kill case of scsi_prep_return we have to
release our device reference, but we do this trying to reference the just
freed command. Use the local sdev pointer instead.
Fixes: 0479633686d370303e3430256ace4bd5f7f138dc
Reported-by: Joe Lawrence <joe.lawrence@stratus.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Diffstat (limited to 'drivers/scsi')
| -rw-r--r-- | drivers/scsi/scsi_lib.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c index 54eff6a..7fa54fe 100644 --- a/drivers/scsi/scsi_lib.c +++ b/drivers/scsi/scsi_lib.c @@ -1274,7 +1274,7 @@ int scsi_prep_return(struct request_queue *q, struct request *req, int ret) struct scsi_cmnd *cmd = req->special; scsi_release_buffers(cmd); scsi_put_command(cmd); - put_device(&cmd->device->sdev_gendev); + put_device(&sdev->sdev_gendev); req->special = NULL; } break; |
