Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi (5b607ba8) · Commits · 戴 / test

Pull SCSI fix from James Bottomley: "One simple fix for a driver use after free" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: vmw_pscsi: Fix use-after-free in pvscsi_queue_lck()

drivers/scsi/vmw_pvscsi.c

+4 −2

Original line number	Diff line number	Diff line
		@@ -763,6 +763,7 @@ static int pvscsi_queue_lck(struct scsi_cmnd cmd, void (done)(struct scsi_cmnd
		struct pvscsi_adapter *adapter = shost_priv(host);
		struct pvscsi_ctx *ctx;
		unsigned long flags;
		unsigned char op;

		spin_lock_irqsave(&adapter->hw_lock, flags);

		@@ -775,13 +776,14 @@ static int pvscsi_queue_lck(struct scsi_cmnd cmd, void (done)(struct scsi_cmnd
		}

		cmd->scsi_done = done;
		op = cmd->cmnd[0];

		dev_dbg(&cmd->device->sdev_gendev,
		"queued cmd %p, ctx %p, op=%x\n", cmd, ctx, cmd->cmnd[0]);
		"queued cmd %p, ctx %p, op=%x\n", cmd, ctx, op);

		spin_unlock_irqrestore(&adapter->hw_lock, flags);

		pvscsi_kick_io(adapter, cmd->cmnd[0]);
		pvscsi_kick_io(adapter, op);

		return 0;
		}

Admin message