summaryrefslogtreecommitdiffstats
path: root/drivers/scsi
diff options
context:
space:
mode:
authorChristoph Hellwig <hch@lst.de>2014-04-15 12:24:56 +0200
committerJames Bottomley <JBottomley@Parallels.com>2014-04-21 07:57:22 -0700
commit68c03d9193f55dad93036f439b94912c5003a173 (patch)
tree86dfc9927fe8b45aed7be80ec589231c3573c835 /drivers/scsi
parent5e012aad85f2ee31d7de5c21d63ccd2702d63db2 (diff)
downloadlinux-68c03d9193f55dad93036f439b94912c5003a173.tar.bz2
[SCSI] don't reference freed command in scsi_prep_return
Patch commit 0479633686d370303e3430256ace4bd5f7f138dc Author: Christoph Hellwig <hch@infradead.org> Date: Thu Feb 20 14:20:55 2014 -0800 [SCSI] do not manipulate device reference counts in scsi_get/put_command Introduced a use after free:I in the kill case of scsi_prep_return we have to release our device reference, but we do this trying to reference the just freed command. Use the local sdev pointer instead. Fixes: 0479633686d370303e3430256ace4bd5f7f138dc Reported-by: Joe Lawrence <joe.lawrence@stratus.com> Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Diffstat (limited to 'drivers/scsi')
-rw-r--r--drivers/scsi/scsi_lib.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 54eff6a79fb8..7fa54fe51f63 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1274,7 +1274,7 @@ int scsi_prep_return(struct request_queue *q, struct request *req, int ret)
struct scsi_cmnd *cmd = req->special;
scsi_release_buffers(cmd);
scsi_put_command(cmd);
- put_device(&cmd->device->sdev_gendev);
+ put_device(&sdev->sdev_gendev);
req->special = NULL;
}
break;