aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDaniel Gryniewicz <dang@linuxbox.com>2014-09-16 10:41:13 -0400
committerJames Bottomley <JBottomley@Parallels.com>2014-09-19 08:23:33 -0400
commitf81426a84bef870d26e5e752772d8ca203cd4aed (patch)
tree83463b74b0232ec854ed7dc79341c2d3ba836265
parente8be1cf58d5b4ddbf8089700df8458f432ed5934 (diff)
[SCSI] fix for bidi use after free
When ending a bi-directionional SCSI request, blk_finish_request() cleans up and frees the request, but scsi_release_bidi_buffers() tries to indirect through the request to find it's data buffers. This causes a panic due to a null pointer dereference. Move the call to scsi_release_bidi_buffers() before the call to blk_finish_request(). Signed-off-by: Daniel Gryniewicz <dang@linuxbox.com> Reviewed-by: Webb Scales <webbnh@hp.com> Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: James Bottomley <JBottomley@Parallels.com>
-rw-r--r--drivers/scsi/scsi_lib.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index d837dc180522..aaea4b98af16 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -733,12 +733,13 @@ static bool scsi_end_request(struct request *req, int error,
733 } else { 733 } else {
734 unsigned long flags; 734 unsigned long flags;
735 735
736 if (bidi_bytes)
737 scsi_release_bidi_buffers(cmd);
738
736 spin_lock_irqsave(q->queue_lock, flags); 739 spin_lock_irqsave(q->queue_lock, flags);
737 blk_finish_request(req, error); 740 blk_finish_request(req, error);
738 spin_unlock_irqrestore(q->queue_lock, flags); 741 spin_unlock_irqrestore(q->queue_lock, flags);
739 742
740 if (bidi_bytes)
741 scsi_release_bidi_buffers(cmd);
742 scsi_release_buffers(cmd); 743 scsi_release_buffers(cmd);
743 scsi_next_command(cmd); 744 scsi_next_command(cmd);
744 } 745 }