diff options
| author | Nicholas Bellinger <nab@linux-iscsi.org> | 2014-05-12 12:18:32 -0700 |
|---|---|---|
| committer | Nicholas Bellinger <nab@linux-iscsi.org> | 2014-05-15 17:09:12 -0700 |
| commit | ed8ec8f707ed4760c124d47b27c93df8ec5b1eba (patch) | |
| tree | a04e8479aec767f070f65971b5acea425c844d77 /drivers/memstick | |
| parent | 7cbfcc953789ff864c2bf8365a82a3fba4869649 (diff) | |
| download | linux-ed8ec8f707ed4760c124d47b27c93df8ec5b1eba.tar.bz2 | |
tcm_fc: Fix free-after-use regression in ft_free_cmd
This patch fixes a free-after-use regression in ft_free_cmd(), where
ft_sess_put() is called with cmd->sess after percpu_ida_free() has
already released the tag.
Fix this bug by saving the ft_sess pointer ahead of percpu_ida_free(),
and pass it directly to ft_sess_put().
The regression was originally introduced in v3.13-rc1 commit:
commit 5f544cfac956971099e906f94568bc3fd1a7108a
Author: Nicholas Bellinger <nab@daterainc.com>
Date: Mon Sep 23 12:12:42 2013 -0700
tcm_fc: Convert to per-cpu command map pre-allocation of ft_cmd
Reported-by: Jun Wu <jwu@stormojo.com>
Cc: Mark Rustad <mark.d.rustad@intel.com>
Cc: Robert Love <robert.w.love@intel.com>
Cc: <stable@vger.kernel.org> #3.13+
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Diffstat (limited to 'drivers/memstick')
0 files changed, 0 insertions, 0 deletions