* [PATCH 2/2] scsi_transport_fc: fix NULL pointer dereference in fc_bsg_job_timeout
[not found] <20170906134416.19980-1-hch@lst.de>
@ 2017-09-06 13:44 ` Christoph Hellwig
0 siblings, 0 replies; 7+ messages in thread
From: Christoph Hellwig @ 2017-09-06 13:44 UTC (permalink / raw)
To: axboe; +Cc: linux-block, linux-scsi, stable
bsg-lib now embeddeds the job structure into the request, and req->special
can't be used anymore.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Cc: stable@vger.kernel.org
---
drivers/scsi/scsi_transport_fc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
index 3c6bc0081fcb..ba9d70f8a6a1 100644
--- a/drivers/scsi/scsi_transport_fc.c
+++ b/drivers/scsi/scsi_transport_fc.c
@@ -3571,7 +3571,7 @@ fc_vport_sched_delete(struct work_struct *work)
static enum blk_eh_timer_return
fc_bsg_job_timeout(struct request *req)
{
- struct bsg_job *job = (void *) req->special;
+ struct bsg_job *job = blk_mq_rq_to_pdu(req);
struct Scsi_Host *shost = fc_bsg_to_shost(job);
struct fc_rport *rport = fc_bsg_to_rport(job);
struct fc_internal *i = to_fc_internal(shost->transportt);
--
2.11.0
^ permalink raw reply related [flat|nested] 7+ messages in thread
* [PATCH 1/2] bsg-lib: don't free job in bsg_prepare_job
[not found] <20170907115436.5069-1-hch@lst.de>
@ 2017-09-07 11:54 ` Christoph Hellwig
2017-09-08 1:28 ` Ming Lei
2017-09-15 4:31 ` Jens Axboe
2017-09-07 11:54 ` [PATCH 2/2] scsi_transport_fc: fix NULL pointer dereference in fc_bsg_job_timeout Christoph Hellwig
1 sibling, 2 replies; 7+ messages in thread
From: Christoph Hellwig @ 2017-09-07 11:54 UTC (permalink / raw)
To: axboe; +Cc: linux-block, linux-scsi, stable
The job structure is allocated as part of the request, so we should not
free it in the error path of bsg_prepare_job.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Cc: stable@vger.kernel.org
---
block/bsg-lib.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/block/bsg-lib.c b/block/bsg-lib.c
index dd56d7460cb9..c587c71d78af 100644
--- a/block/bsg-lib.c
+++ b/block/bsg-lib.c
@@ -154,7 +154,6 @@ static int bsg_prepare_job(struct device *dev, struct request *req)
failjob_rls_rqst_payload:
kfree(job->request_payload.sg_list);
failjob_rls_job:
- kfree(job);
return -ENOMEM;
}
--
2.11.0
^ permalink raw reply related [flat|nested] 7+ messages in thread
* [PATCH 2/2] scsi_transport_fc: fix NULL pointer dereference in fc_bsg_job_timeout
[not found] <20170907115436.5069-1-hch@lst.de>
2017-09-07 11:54 ` [PATCH 1/2] bsg-lib: don't free job in bsg_prepare_job Christoph Hellwig
@ 2017-09-07 11:54 ` Christoph Hellwig
2017-09-08 1:29 ` Ming Lei
2017-09-15 0:40 ` Martin K. Petersen
1 sibling, 2 replies; 7+ messages in thread
From: Christoph Hellwig @ 2017-09-07 11:54 UTC (permalink / raw)
To: axboe; +Cc: linux-block, linux-scsi, stable
bsg-lib now embeddeds the job structure into the request, and req->special
can't be used anymore.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Cc: stable@vger.kernel.org
---
drivers/scsi/scsi_transport_fc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
index 892fbd9800d9..bea06de60827 100644
--- a/drivers/scsi/scsi_transport_fc.c
+++ b/drivers/scsi/scsi_transport_fc.c
@@ -3550,7 +3550,7 @@ fc_vport_sched_delete(struct work_struct *work)
static enum blk_eh_timer_return
fc_bsg_job_timeout(struct request *req)
{
- struct bsg_job *job = (void *) req->special;
+ struct bsg_job *job = blk_mq_rq_to_pdu(req);
struct Scsi_Host *shost = fc_bsg_to_shost(job);
struct fc_rport *rport = fc_bsg_to_rport(job);
struct fc_internal *i = to_fc_internal(shost->transportt);
--
2.11.0
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH 1/2] bsg-lib: don't free job in bsg_prepare_job
2017-09-07 11:54 ` [PATCH 1/2] bsg-lib: don't free job in bsg_prepare_job Christoph Hellwig
@ 2017-09-08 1:28 ` Ming Lei
2017-09-15 4:31 ` Jens Axboe
1 sibling, 0 replies; 7+ messages in thread
From: Ming Lei @ 2017-09-08 1:28 UTC (permalink / raw)
To: Christoph Hellwig; +Cc: axboe, linux-block, linux-scsi, stable
On Thu, Sep 07, 2017 at 01:54:35PM +0200, Christoph Hellwig wrote:
> The job structure is allocated as part of the request, so we should not
> free it in the error path of bsg_prepare_job.
>
> Signed-off-by: Christoph Hellwig <hch@lst.de>
> Cc: stable@vger.kernel.org
> ---
> block/bsg-lib.c | 1 -
> 1 file changed, 1 deletion(-)
>
> diff --git a/block/bsg-lib.c b/block/bsg-lib.c
> index dd56d7460cb9..c587c71d78af 100644
> --- a/block/bsg-lib.c
> +++ b/block/bsg-lib.c
> @@ -154,7 +154,6 @@ static int bsg_prepare_job(struct device *dev, struct request *req)
> failjob_rls_rqst_payload:
> kfree(job->request_payload.sg_list);
> failjob_rls_job:
> - kfree(job);
> return -ENOMEM;
> }
>
> --
> 2.11.0
>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
--
Ming
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH 2/2] scsi_transport_fc: fix NULL pointer dereference in fc_bsg_job_timeout
2017-09-07 11:54 ` [PATCH 2/2] scsi_transport_fc: fix NULL pointer dereference in fc_bsg_job_timeout Christoph Hellwig
@ 2017-09-08 1:29 ` Ming Lei
2017-09-15 0:40 ` Martin K. Petersen
1 sibling, 0 replies; 7+ messages in thread
From: Ming Lei @ 2017-09-08 1:29 UTC (permalink / raw)
To: Christoph Hellwig; +Cc: axboe, linux-block, linux-scsi, stable
On Thu, Sep 07, 2017 at 01:54:36PM +0200, Christoph Hellwig wrote:
> bsg-lib now embeddeds the job structure into the request, and req->special
> can't be used anymore.
>
> Signed-off-by: Christoph Hellwig <hch@lst.de>
> Cc: stable@vger.kernel.org
> ---
> drivers/scsi/scsi_transport_fc.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
> index 892fbd9800d9..bea06de60827 100644
> --- a/drivers/scsi/scsi_transport_fc.c
> +++ b/drivers/scsi/scsi_transport_fc.c
> @@ -3550,7 +3550,7 @@ fc_vport_sched_delete(struct work_struct *work)
> static enum blk_eh_timer_return
> fc_bsg_job_timeout(struct request *req)
> {
> - struct bsg_job *job = (void *) req->special;
> + struct bsg_job *job = blk_mq_rq_to_pdu(req);
> struct Scsi_Host *shost = fc_bsg_to_shost(job);
> struct fc_rport *rport = fc_bsg_to_rport(job);
> struct fc_internal *i = to_fc_internal(shost->transportt);
> --
> 2.11.0
>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
--
Ming
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH 2/2] scsi_transport_fc: fix NULL pointer dereference in fc_bsg_job_timeout
2017-09-07 11:54 ` [PATCH 2/2] scsi_transport_fc: fix NULL pointer dereference in fc_bsg_job_timeout Christoph Hellwig
2017-09-08 1:29 ` Ming Lei
@ 2017-09-15 0:40 ` Martin K. Petersen
1 sibling, 0 replies; 7+ messages in thread
From: Martin K. Petersen @ 2017-09-15 0:40 UTC (permalink / raw)
To: Christoph Hellwig; +Cc: axboe, linux-block, linux-scsi, stable
Christoph,
> bsg-lib now embeddeds the job structure into the request, and
> req->special can't be used anymore.
Applied to 4.14/scsi-fixes.
--
Martin K. Petersen Oracle Linux Engineering
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH 1/2] bsg-lib: don't free job in bsg_prepare_job
2017-09-07 11:54 ` [PATCH 1/2] bsg-lib: don't free job in bsg_prepare_job Christoph Hellwig
2017-09-08 1:28 ` Ming Lei
@ 2017-09-15 4:31 ` Jens Axboe
1 sibling, 0 replies; 7+ messages in thread
From: Jens Axboe @ 2017-09-15 4:31 UTC (permalink / raw)
To: Christoph Hellwig; +Cc: linux-block, linux-scsi, stable
On 09/07/2017 05:54 AM, Christoph Hellwig wrote:
> The job structure is allocated as part of the request, so we should not
> free it in the error path of bsg_prepare_job.
Added for this series, thanks.
--
Jens Axboe
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2017-09-15 4:31 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <20170907115436.5069-1-hch@lst.de>
2017-09-07 11:54 ` [PATCH 1/2] bsg-lib: don't free job in bsg_prepare_job Christoph Hellwig
2017-09-08 1:28 ` Ming Lei
2017-09-15 4:31 ` Jens Axboe
2017-09-07 11:54 ` [PATCH 2/2] scsi_transport_fc: fix NULL pointer dereference in fc_bsg_job_timeout Christoph Hellwig
2017-09-08 1:29 ` Ming Lei
2017-09-15 0:40 ` Martin K. Petersen
[not found] <20170906134416.19980-1-hch@lst.de>
2017-09-06 13:44 ` Christoph Hellwig
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).