mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-16 07:35:14 +00:00
IB/srp: Fix use-after-free in srp_reset_req()
srp_free_req() uses the scsi_cmnd structure contents to unmap buffers, so we must invoke srp_free_req() before we release ownership of that structure. Signed-off-by: Bart Van Assche <bvanassche@acm.org> Acked-by: David Dillow <dillowda@ornl.gov> Cc: <stable@vger.kernel.org> Signed-off-by: Roland Dreier <roland@purestorage.com>
This commit is contained in:
parent
979570e029
commit
9b796d06d5
1 changed files with 1 additions and 1 deletions
|
@ -638,9 +638,9 @@ static void srp_reset_req(struct srp_target_port *target, struct srp_request *re
|
||||||
struct scsi_cmnd *scmnd = srp_claim_req(target, req, NULL);
|
struct scsi_cmnd *scmnd = srp_claim_req(target, req, NULL);
|
||||||
|
|
||||||
if (scmnd) {
|
if (scmnd) {
|
||||||
|
srp_free_req(target, req, scmnd, 0);
|
||||||
scmnd->result = DID_RESET << 16;
|
scmnd->result = DID_RESET << 16;
|
||||||
scmnd->scsi_done(scmnd);
|
scmnd->scsi_done(scmnd);
|
||||||
srp_free_req(target, req, scmnd, 0);
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue