diff options
author | Daniel Gryniewicz <dang@linuxbox.com> | 2014-09-16 10:41:13 -0400 |
---|---|---|
committer | James Bottomley <JBottomley@Parallels.com> | 2014-09-19 08:23:33 -0400 |
commit | f81426a84bef870d26e5e752772d8ca203cd4aed (patch) | |
tree | 83463b74b0232ec854ed7dc79341c2d3ba836265 | |
parent | e8be1cf58d5b4ddbf8089700df8458f432ed5934 (diff) |
[SCSI] fix for bidi use after free
When ending a bi-directionional SCSI request, blk_finish_request()
cleans up and frees the request, but scsi_release_bidi_buffers() tries
to indirect through the request to find it's data buffers. This causes
a panic due to a null pointer dereference.
Move the call to scsi_release_bidi_buffers() before the call to
blk_finish_request().
Signed-off-by: Daniel Gryniewicz <dang@linuxbox.com>
Reviewed-by: Webb Scales <webbnh@hp.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
-rw-r--r-- | drivers/scsi/scsi_lib.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c index d837dc180522..aaea4b98af16 100644 --- a/drivers/scsi/scsi_lib.c +++ b/drivers/scsi/scsi_lib.c | |||
@@ -733,12 +733,13 @@ static bool scsi_end_request(struct request *req, int error, | |||
733 | } else { | 733 | } else { |
734 | unsigned long flags; | 734 | unsigned long flags; |
735 | 735 | ||
736 | if (bidi_bytes) | ||
737 | scsi_release_bidi_buffers(cmd); | ||
738 | |||
736 | spin_lock_irqsave(q->queue_lock, flags); | 739 | spin_lock_irqsave(q->queue_lock, flags); |
737 | blk_finish_request(req, error); | 740 | blk_finish_request(req, error); |
738 | spin_unlock_irqrestore(q->queue_lock, flags); | 741 | spin_unlock_irqrestore(q->queue_lock, flags); |
739 | 742 | ||
740 | if (bidi_bytes) | ||
741 | scsi_release_bidi_buffers(cmd); | ||
742 | scsi_release_buffers(cmd); | 743 | scsi_release_buffers(cmd); |
743 | scsi_next_command(cmd); | 744 | scsi_next_command(cmd); |
744 | } | 745 | } |