summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorChristoph Hellwig <hch@lst.de>2014-04-15 12:24:56 +0200
committerJens Axboe <axboe@fb.com>2015-04-02 12:12:26 -0600
commit4115d659efd7fdcd9c244df20715ed35a7c7a5e6 (patch)
tree0dfbd51d7ab14e09829804adf9c5fc5d7c4bcff3
parent70fa269fa849e7c6042f6f9399df3748846bb658 (diff)
don't reference freed command in scsi_prep_return
Patch commit 0479633686d370303e3430256ace4bd5f7f138dc Author: Christoph Hellwig <hch@infradead.org> Date: Thu Feb 20 14:20:55 2014 -0800 [SCSI] do not manipulate device reference counts in scsi_get/put_command Introduced a use after free:I in the kill case of scsi_prep_return we have to release our device reference, but we do this trying to reference the just freed command. Use the local sdev pointer instead. Fixes: 0479633686d370303e3430256ace4bd5f7f138dc Reported-by: Joe Lawrence <joe.lawrence@stratus.com> Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: James Bottomley <JBottomley@Parallels.com>
-rw-r--r--drivers/scsi/scsi_lib.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index f5c0b438fc52..8d456357873c 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1266,7 +1266,7 @@ int scsi_prep_return(struct request_queue *q, struct request *req, int ret)
struct scsi_cmnd *cmd = req->special;
scsi_release_buffers(cmd);
scsi_put_command(cmd);
- put_device(&cmd->device->sdev_gendev);
+ put_device(&sdev->sdev_gendev);
req->special = NULL;
}
break;