From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
alan@lxorguk.ukuu.org.uk, Bart Van Assche <bvanassche@acm.org>,
David Dillow <dillowda@ornl.gov>,
Roland Dreier <roland@purestorage.com>
Subject: [ 27/33] IB/srp: Fix use-after-free in srp_reset_req()
Date: Thu, 4 Oct 2012 14:26:49 -0700 [thread overview]
Message-ID: <20121004210601.870724470@linuxfoundation.org> (raw)
In-Reply-To: <20121004210558.383865383@linuxfoundation.org>
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <bvanassche@acm.org>
commit 9b796d06d5d1b1e85ae2316a283ea11dd739ef96 upstream.
srp_free_req() uses the scsi_cmnd structure contents to unmap
buffers, so we must invoke srp_free_req() before we release
ownership of that structure.
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Acked-by: David Dillow <dillowda@ornl.gov>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/ulp/srp/ib_srp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -620,9 +620,9 @@ static void srp_reset_req(struct srp_tar
struct scsi_cmnd *scmnd = srp_claim_req(target, req, NULL);
if (scmnd) {
+ srp_free_req(target, req, scmnd, 0);
scmnd->result = DID_RESET << 16;
scmnd->scsi_done(scmnd);
- srp_free_req(target, req, scmnd, 0);
}
}
next prev parent reply other threads:[~2012-10-04 21:30 UTC|newest]
Thread overview: 34+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-10-04 21:26 [ 00/33] 3.0.45-stable review Greg Kroah-Hartman
2012-10-04 21:26 ` [ 01/33] vfs: dcache: fix deadlock in tree traversal Greg Kroah-Hartman
2012-10-04 21:26 ` [ 02/33] dm: handle requests beyond end of device instead of using BUG_ON Greg Kroah-Hartman
2012-10-04 21:26 ` [ 03/33] USB: option: blacklist QMI interface on ZTE MF683 Greg Kroah-Hartman
2012-10-04 21:26 ` [ 04/33] USB: ftdi_sio: add TIAO USB Multi-Protocol Adapter (TUMPA) support Greg Kroah-Hartman
2012-10-04 21:26 ` [ 05/33] USB: qcaux: add Pantech vendor class match Greg Kroah-Hartman
2012-10-04 21:26 ` [ 06/33] staging: speakup_soft: Fix reading of init string Greg Kroah-Hartman
2012-10-04 21:26 ` [ 07/33] staging: comedi: s626: dont dereference insn->data Greg Kroah-Hartman
2012-10-04 21:26 ` [ 08/33] staging: comedi: jr3_pci: fix iomem dereference Greg Kroah-Hartman
2012-10-04 21:26 ` [ 09/33] staging: comedi: dont dereference user memory for INSN_INTTRIG Greg Kroah-Hartman
2012-10-04 21:26 ` [ 10/33] staging: comedi: fix memory leak for saved channel list Greg Kroah-Hartman
2012-10-04 21:26 ` [ 11/33] Remove BUG_ON from n_tty_read() Greg Kroah-Hartman
2012-10-04 21:26 ` [ 12/33] TTY: ttyprintk, dont touch behind tty->write_buf Greg Kroah-Hartman
2012-10-04 21:26 ` [ 13/33] serial: pl011: handle corruption at high clock speeds Greg Kroah-Hartman
2012-10-04 21:26 ` [ 14/33] serial: set correct baud_base for EXSYS EX-41092 Dual 16950 Greg Kroah-Hartman
2012-10-04 21:26 ` [ 15/33] b43legacy: Fix crash on unload when firmware not available Greg Kroah-Hartman
2012-10-04 21:26 ` [ 16/33] firmware: Add missing attributes to EFI variable attribute print out from sysfs Greg Kroah-Hartman
2012-10-04 21:26 ` [ 17/33] xhci: Intel Panther Point BEI quirk Greg Kroah-Hartman
2012-10-04 21:26 ` [ 18/33] n_gsm: added interlocking for gsm_data_lock for certain code paths Greg Kroah-Hartman
2012-10-04 21:26 ` [ 19/33] coredump: prevent double-free on an error path in core dumper Greg Kroah-Hartman
2012-10-04 21:26 ` [ 20/33] Increase XHCI suspend timeout to 16ms Greg Kroah-Hartman
2012-10-04 21:26 ` [ 21/33] n_gsm: memory leak in uplink error path Greg Kroah-Hartman
2012-10-04 21:26 ` [ 22/33] UBI: fix autoresize handling in R/O mode Greg Kroah-Hartman
2012-10-04 21:26 ` [ 23/33] SCSI: ibmvscsi: Fix host config length field overflow Greg Kroah-Hartman
2012-10-04 21:26 ` [ 24/33] SCSI: hpsa: Use LUN reset instead of target reset Greg Kroah-Hartman
2012-10-04 21:26 ` [ 25/33] can: mscan-mpc5xxx: fix return value check in mpc512x_can_get_clock() Greg Kroah-Hartman
2012-10-04 21:26 ` [ 26/33] IPoIB: Fix use-after-free of multicast object Greg Kroah-Hartman
2012-10-04 21:26 ` Greg Kroah-Hartman [this message]
2012-10-04 21:26 ` [ 28/33] IB/srp: Avoid having aborted requests hang Greg Kroah-Hartman
2012-10-04 21:26 ` [ 29/33] isci: fix isci_pci_probe() generates warning on efi failure path Greg Kroah-Hartman
2012-10-04 21:26 ` [ 30/33] x86/alternatives: Fix p6 nops on non-modular kernels Greg Kroah-Hartman
2012-10-04 21:26 ` [ 31/33] PCI: honor child buses add_size in hot plug configuration Greg Kroah-Hartman
2012-10-04 21:26 ` [ 32/33] SCSI: scsi_remove_target: fix softlockup regression on hot remove Greg Kroah-Hartman
2012-10-04 21:26 ` [ 33/33] SCSI: scsi_dh_alua: Enable STPG for unavailable ports Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20121004210601.870724470@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=bvanassche@acm.org \
--cc=dillowda@ornl.gov \
--cc=linux-kernel@vger.kernel.org \
--cc=roland@purestorage.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).