projects
/
GitHub
/
exynos8895
/
android_kernel_samsung_universal8895.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
7e44331
)
[SCSI] fix use-after-free in scsi_init_io()
author
James Bottomley
<James.Bottomley@suse.de>
Mon, 16 Aug 2010 15:06:26 +0000
(10:06 -0500)
committer
James Bottomley
<James.Bottomley@suse.de>
Thu, 9 Sep 2010 14:58:18 +0000
(09:58 -0500)
we're using a pointer through a freed command to reset the request,
which has shown up as an oops with slab poisoning:
Reported-by: Tejun Heo <tj@kernel.org>
Reported-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>
drivers/scsi/scsi_lib.c
patch
|
blob
|
blame
|
history
diff --git
a/drivers/scsi/scsi_lib.c
b/drivers/scsi/scsi_lib.c
index 9ade720422c685f01ab8f7fe3b625bfc054390d7..ee02d3838a0a41e09fbfff0096483ad3a24eb968 100644
(file)
--- a/
drivers/scsi/scsi_lib.c
+++ b/
drivers/scsi/scsi_lib.c
@@
-1011,8
+1011,8
@@
int scsi_init_io(struct scsi_cmnd *cmd, gfp_t gfp_mask)
err_exit:
scsi_release_buffers(cmd);
- scsi_put_command(cmd);
cmd->request->special = NULL;
+ scsi_put_command(cmd);
return error;
}
EXPORT_SYMBOL(scsi_init_io);