Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
Pull SCSI fix from James Bottomley:
"One simple fix for a driver use after free"
* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
scsi: vmw_pscsi: Fix use-after-free in pvscsi_queue_lck()
+4
-2
+4
-2
drivers/scsi/vmw_pvscsi.c
+4
-2
drivers/scsi/vmw_pvscsi.c
···
763
763
struct pvscsi_adapter *adapter = shost_priv(host);
764
764
struct pvscsi_ctx *ctx;
765
765
unsigned long flags;
766
+
unsigned char op;
766
767
767
768
spin_lock_irqsave(&adapter->hw_lock, flags);
768
769
···
776
775
}
777
776
778
777
cmd->scsi_done = done;
778
+
op = cmd->cmnd[0];
779
779
780
780
dev_dbg(&cmd->device->sdev_gendev,
781
-
"queued cmd %p, ctx %p, op=%x\n", cmd, ctx, cmd->cmnd[0]);
781
+
"queued cmd %p, ctx %p, op=%x\n", cmd, ctx, op);
782
782
783
783
spin_unlock_irqrestore(&adapter->hw_lock, flags);
784
784
785
-
pvscsi_kick_io(adapter, cmd->cmnd[0]);
785
+
pvscsi_kick_io(adapter, op);
786
786
787
787
return 0;
788
788
}