diff options
| author | Bart Van Assche <bart.vanassche@sandisk.com> | 2017-05-24 01:48:36 +0200 |
|---|---|---|
| committer | Nicholas Bellinger <nab@linux-iscsi.org> | 2017-07-07 07:58:01 +0200 |
| commit | 9f4ab18ac51dc87345a9cbd2527e6acf7a0a9335 (patch) | |
| tree | b6b1e76341fc59162c054ea19d13b87a0ffd4954 /Documentation | |
| parent | IB/srpt: Make a debug statement in srpt_abort_cmd() more informative (diff) | |
| download | linux-9f4ab18ac51dc87345a9cbd2527e6acf7a0a9335.tar.xz linux-9f4ab18ac51dc87345a9cbd2527e6acf7a0a9335.zip | |
xen/scsiback: Fix a TMR related use-after-free
scsiback_release_cmd() must not dereference se_cmd->se_tmr_req
because that memory is freed by target_free_cmd_mem() before
scsiback_release_cmd() is called. Fix this use-after-free by
inlining struct scsiback_tmr into struct vscsibk_pend.
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Hannes Reinecke <hare@suse.com>
Cc: David Disseldorp <ddiss@suse.de>
Cc: xen-devel@lists.xenproject.org
Cc: <stable@vger.kernel.org> # 3.18+
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Diffstat (limited to 'Documentation')
0 files changed, 0 insertions, 0 deletions