summaryrefslogtreecommitdiffstats
path: root/drivers/scsi/scsi_lib.c
diff options
context:
space:
mode:
authorDaniel Gryniewicz <dang@linuxbox.com>2014-09-16 16:41:13 +0200
committerJames Bottomley <JBottomley@Parallels.com>2014-09-19 14:23:33 +0200
commitf81426a84bef870d26e5e752772d8ca203cd4aed (patch)
tree83463b74b0232ec854ed7dc79341c2d3ba836265 /drivers/scsi/scsi_lib.c
parent[SCSI] fix regression that accidentally disabled block-based tcq (diff)
downloadlinux-f81426a84bef870d26e5e752772d8ca203cd4aed.tar.xz
linux-f81426a84bef870d26e5e752772d8ca203cd4aed.zip
[SCSI] fix for bidi use after free
When ending a bi-directionional SCSI request, blk_finish_request() cleans up and frees the request, but scsi_release_bidi_buffers() tries to indirect through the request to find it's data buffers. This causes a panic due to a null pointer dereference. Move the call to scsi_release_bidi_buffers() before the call to blk_finish_request(). Signed-off-by: Daniel Gryniewicz <dang@linuxbox.com> Reviewed-by: Webb Scales <webbnh@hp.com> Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Diffstat (limited to 'drivers/scsi/scsi_lib.c')
-rw-r--r--drivers/scsi/scsi_lib.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index d837dc180522..aaea4b98af16 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -733,12 +733,13 @@ static bool scsi_end_request(struct request *req, int error,
} else {
unsigned long flags;
+ if (bidi_bytes)
+ scsi_release_bidi_buffers(cmd);
+
spin_lock_irqsave(q->queue_lock, flags);
blk_finish_request(req, error);
spin_unlock_irqrestore(q->queue_lock, flags);
- if (bidi_bytes)
- scsi_release_bidi_buffers(cmd);
scsi_release_buffers(cmd);
scsi_next_command(cmd);
}