Christoph Hellwig 5e012aad85 [SCSI] don't reference freed command in scsi_init_sgtable ...

Patch

commit 0479633686d370303e3430256ace4bd5f7f138dc
Author: Christoph Hellwig <hch@infradead.org>
Date:   Thu Feb 20 14:20:55 2014 -0800

    [SCSI] do not manipulate device reference counts in scsi_get/put_command

Introduced a use after free: when scsi_init_io fails we have to release our
device reference, but we do this trying to reference the just freed command.
Add a local scsi_device pointer to fix this.

Fixes: 0479633686d370303e3430256ace4bd5f7f138dc
Reported-by: Sander Eikelenboom <linux@eikelenboom.it>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

2014-04-21 07:57:21 -07:00

..

aacraid

[SCSI] remove deprecated IRQF_DISABLED from SCSI

2014-03-19 15:04:44 -07:00

aic7xxx

[SCSI] remove deprecated IRQF_DISABLED from SCSI

2014-03-19 15:04:44 -07:00

aic94xx

[SCSI] libsas: implement > 16 byte CDB support

2013-06-04 11:15:59 -07:00

arcmsr

[SCSI] arcmsr: upper 32 of dma address lost

2014-03-15 10:19:19 -07:00

arm

[SCSI] remove deprecated IRQF_DISABLED from SCSI

2014-03-19 15:04:44 -07:00

be2iscsi

Merge branch 'for-3.15/core' of git://git.kernel.dk/linux-block

2014-04-01 19:19:15 -07:00

bfa

[SCSI] bfa: Replace large udelay() with mdelay()

2014-03-19 15:04:47 -07:00

bnx2fc

CPU hotplug notifiers registration fixes for 3.15-rc1

2014-04-07 14:55:46 -07:00

bnx2i

CPU hotplug notifiers registration fixes for 3.15-rc1

2014-04-07 14:55:46 -07:00

csiostor

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial

2013-11-15 16:47:22 -08:00

cxgbi

[SCSI] cxgb4i: Use cxgb4_select_ntuple to correctly calculate ntuple fields

2014-03-15 10:19:18 -07:00

device_handler

[SCSI] scsi_dh_alua: ALUA handler attach should succeed while TPG is transitioning

2013-10-25 11:19:33 +01:00

dpt

atomic: use <linux/atomic.h>

2011-07-26 16:49:47 -07:00

esas2r

[SCSI] remove deprecated IRQF_DISABLED from SCSI

2014-03-19 15:04:44 -07:00

fcoe

scsi, fcoe: Fix CPU hotplug callback registration

2014-03-20 13:43:45 +01:00

fnic

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial

2013-11-15 16:47:22 -08:00

ibmvscsi

[SCSI] remove deprecated IRQF_DISABLED from SCSI

2014-03-19 15:04:44 -07:00

isci

[SCSI] isci: update version to 1.2

2014-03-15 10:19:17 -07:00

libfc

fcp: Do not interpret check condition as underrun

2013-09-04 13:52:35 -07:00

libsas

SCSI misc on 20140401

2014-04-01 18:49:04 -07:00

lpfc

[SCSI] lpfc: use NULL instead of 0 for pointer

2014-03-15 10:18:58 -07:00

megaraid

[SCSI] megaraid_sas: Version and Changelog update

2014-03-15 10:19:21 -07:00

mpt2sas

Merge branch 'for-3.14/core' of git://git.kernel.dk/linux-block

2014-01-30 11:19:05 -08:00

mpt3sas

Merge branch 'for-3.14/core' of git://git.kernel.dk/linux-block

2014-01-30 11:19:05 -08:00

mvsas

SCSI: remove unnecessary pci_set_drvdata()

2013-10-14 15:26:04 +02:00

osd

block: Abstract out bvec iterator

2013-11-23 22:33:47 -08:00

pcmcia

nsp_cs: switch to ->show_info()

2013-04-09 14:13:21 -04:00

pm8001

[SCSI] remove deprecated IRQF_DISABLED from SCSI

2014-03-19 15:04:44 -07:00

qla2xxx

Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending

2014-04-12 16:51:08 -07:00

qla4xxx

[SCSI] libiscsi: Reduce locking contention in fast path

2014-03-15 10:19:18 -07:00

sym53c8xx_2

sym53c8xx_2: Set DID_REQUEUE return code when aborting squeue

2014-04-12 18:02:16 -07:00

ufs

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial

2013-11-15 16:47:22 -08:00

.gitignore

…

3w-9xxx.c

[SCSI] Disable WRITE SAME for RAID and virtual host adapter drivers

2013-11-29 08:48:39 +04:00

3w-9xxx.h

Fix common misspellings

2011-03-31 11:26:23 -03:00

3w-sas.c

[SCSI] Disable WRITE SAME for RAID and virtual host adapter drivers

2013-11-29 08:48:39 +04:00

3w-sas.h

…

3w-xxxx.c

[SCSI] Disable WRITE SAME for RAID and virtual host adapter drivers

2013-11-29 08:48:39 +04:00

3w-xxxx.h

Fix common misspellings

2011-03-31 11:26:23 -03:00

53c700_d.h_shipped

Fix common misspellings

2011-03-31 11:26:23 -03:00

53c700.c

Remove all #inclusions of asm/system.h

2012-03-28 18:30:03 +01:00

53c700.h

…

53c700.scr

Fix common misspellings

2011-03-31 11:26:23 -03:00

a100u2w.c

Drivers: scsi: remove __dev* attributes.

2013-01-03 15:57:01 -08:00

a100u2w.h

…

a2091.c

zorro: ZTWO_VADDR() should return "void __iomem *"

2013-11-26 11:09:07 +01:00

a2091.h

…

a3000.c

zorro: ZTWO_VADDR() should return "void __iomem *"

2013-11-26 11:09:07 +01:00

a3000.h

…

a4000t.c

zorro: ZTWO_VADDR() should return "void __iomem *"

2013-11-26 11:09:07 +01:00

advansys.c

[SCSI] advansys: Remove 'last_reset' references

2013-10-25 11:44:54 +01:00

aha152x.c

[SCSI] remove deprecated IRQF_DISABLED from SCSI

2014-03-19 15:04:44 -07:00

aha152x.h

…

aha1542.c

treewide: Put a space between #include and FILE

2012-06-28 11:44:36 +02:00

aha1542.h

…

aha1740.c

aha1740: switch to ->show_info()

2013-04-09 14:13:23 -04:00

aha1740.h

…

atari_NCR5380.c

atari_scsi: switch to ->show_info()

2013-04-09 14:13:29 -04:00

atari_scsi.c

[SCSI] atari_scsi: Fix sleep_on race

2014-03-10 21:15:09 +01:00

atari_scsi.h

atari_scsi: switch to ->show_info()

2013-04-09 14:13:29 -04:00

atp870u.c

SCSI: remove unnecessary pci_set_drvdata()

2013-10-14 15:26:04 +02:00

atp870u.h

…

BusLogic.c

[SCSI] buslogic: Added check for DMA mapping errors

2013-10-25 09:57:57 +01:00

BusLogic.h

[SCSI] BusLogic: Port driver to 64-bit.

2013-06-26 18:32:47 -07:00

bvme6000_scsi.c

Drivers: scsi: remove __dev* attributes.

2013-01-03 15:57:01 -08:00

ch.c

scsi: convert to idr_alloc()

2013-02-27 19:10:18 -08:00

constants.c

[SCSI] scsi constants: command, sense key + additional sense strings

2013-07-09 22:52:29 +01:00

dc395x.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial

2013-11-15 16:47:22 -08:00

dc395x.h

Fix common misspellings

2011-03-31 11:26:23 -03:00

dmx3191d.c

Drivers: scsi: remove __dev* attributes.

2013-01-03 15:57:01 -08:00

dpt_i2o.c

[SCSI] dpt_i2o: return SCSI_MLQUEUE_HOST_BUSY when in reset

2013-10-25 11:40:42 +01:00

dpti.h

[SCSI] dpt_i2o: Remove DPTI_STATE_IOCTL

2013-10-25 11:36:26 +01:00

dtc.c

[SCSI] remove deprecated IRQF_DISABLED from SCSI

2014-03-19 15:04:44 -07:00

dtc.h

NCR5830: switch to ->show_info()

2013-04-09 14:13:17 -04:00

eata_generic.h

…

eata_pio.c

[SCSI] remove deprecated IRQF_DISABLED from SCSI

2014-03-19 15:04:44 -07:00

eata_pio.h

…

eata.c

[SCSI] remove deprecated IRQF_DISABLED from SCSI

2014-03-19 15:04:44 -07:00

esp_scsi.c

esp_scsi: Fix tag state corruption when autosensing.

2013-08-01 18:08:34 -07:00

esp_scsi.h

esp_scsi: Fix tag state corruption when autosensing.

2013-08-01 18:08:34 -07:00

fdomain.c

Drivers: scsi: remove __dev* attributes.

2013-01-03 15:57:01 -08:00

fdomain.h

…

FlashPoint.c

[SCSI] BusLogic: Port driver to 64-bit.

2013-06-26 18:32:47 -07:00

g_NCR5380_mmio.c

…

g_NCR5380.c

[SCSI] remove deprecated IRQF_DISABLED from SCSI

2014-03-19 15:04:44 -07:00

g_NCR5380.h

…

gdth_ioctl.h

…

gdth_proc.c

gdth: switch to ->show_info()

2013-04-09 14:13:16 -04:00

gdth_proc.h

gdth: switch to ->show_info()

2013-04-09 14:13:16 -04:00

gdth.c

[SCSI] remove deprecated IRQF_DISABLED from SCSI

2014-03-19 15:04:44 -07:00

gdth.h

gdth: switch to ->show_info()

2013-04-09 14:13:16 -04:00

gvp11.c

zorro: ZTWO_VADDR() should return "void __iomem *"

2013-11-26 11:09:07 +01:00

gvp11.h

…

hosts.c

[SCSI] scsi_error: disable eh_deadline if no host_reset_handler is set

2014-03-15 10:18:59 -07:00

hpsa_cmd.h

[SCSI] hpsa: Add hba mode to the hpsa driver

2014-03-15 10:19:23 -07:00

hpsa.c

[SCSI] hpsa: fix NULL dereference in hpsa_put_ctlr_into_performant_mode()

2014-04-21 07:56:53 -07:00

hpsa.h

[SCSI] hpsa: Add hba mode to the hpsa driver

2014-03-15 10:19:23 -07:00

hptiop.c

Drivers: scsi: remove __dev* attributes.

2013-01-03 15:57:01 -08:00

hptiop.h

[SCSI] hptiop: Support HighPoint RR4520/RR4522 HBA

2012-11-27 08:59:43 +04:00

imm.c

imm: switch to ->show_info()

2013-04-09 14:13:16 -04:00

imm.h

…

in2000.c

[SCSI] remove deprecated IRQF_DISABLED from SCSI

2014-03-19 15:04:44 -07:00

in2000.h

…

initio.c

[SCSI] remove deprecated IRQF_DISABLED from SCSI

2014-03-19 15:04:44 -07:00

initio.h

Fix common misspellings

2011-03-31 11:26:23 -03:00

ipr.c

Merge branch 'for-3.15/core' of git://git.kernel.dk/linux-block

2014-04-01 19:19:15 -07:00

ipr.h

[SCSI] ipr: Add new CCIN definition for Grand Canyon support

2014-03-19 15:04:42 -07:00

ips.c

[SCSI] Disable WRITE SAME for RAID and virtual host adapter drivers

2013-11-29 08:48:39 +04:00

ips.h

ips: switch to ->show_info()

2013-04-09 14:13:27 -04:00

iscsi_boot_sysfs.c

[SCSI] iscsi_boot_sysfs: Fix a memory leak in iscsi_boot_destroy_kset()

2014-03-15 10:19:19 -07:00

iscsi_tcp.c

net: Fix use after free by removing length arg from sk_data_ready callbacks.

2014-04-11 16:15:36 -04:00

iscsi_tcp.h

net: Fix use after free by removing length arg from sk_data_ready callbacks.

2014-04-11 16:15:36 -04:00

jazz_esp.c

Drivers: scsi: remove __dev* attributes.

2013-01-03 15:57:01 -08:00

Kconfig

scsi: async sd resume

2014-04-10 15:30:35 -07:00

lasi700.c

Drivers: scsi: remove __dev* attributes.

2013-01-03 15:57:01 -08:00

libiscsi_tcp.c

[SCSI] libiscsi: Reduce locking contention in fast path

2014-03-15 10:19:18 -07:00

libiscsi.c

Main batch of InfiniBand/RDMA changes for 3.15:

2014-04-03 16:57:19 -07:00

libsrp.c

scsi: Fix up files implicitly depending on module.h inclusion

2011-10-31 19:31:24 -04:00

mac53c94.c

Remove all #inclusions of asm/system.h

2012-03-28 18:30:03 +01:00

mac53c94.h

…

mac_esp.c

Drivers: scsi: remove __dev* attributes.

2013-01-03 15:57:01 -08:00

mac_scsi.c

[SCSI] mac_scsi: Fix crash on out of memory

2013-12-19 20:56:28 -08:00

mac_scsi.h

NCR5830: switch to ->show_info()

2013-04-09 14:13:17 -04:00

Makefile

[SCSI] aci7xxx_old: delete decade+ obsolete driver

2013-12-19 07:39:02 -08:00

megaraid.c

[SCSI] megaraid: simplify internal command handling

2014-03-27 08:26:31 -07:00

megaraid.h

[SCSI] megaraid: simplify internal command handling

2014-03-27 08:26:31 -07:00

mesh.c

Remove all #inclusions of asm/system.h

2012-03-28 18:30:03 +01:00

mesh.h

…

mvme16x_scsi.c

Drivers: scsi: remove __dev* attributes.

2013-01-03 15:57:01 -08:00

mvme147.c

switch wd33c93 to ->show_info()

2013-04-09 14:13:15 -04:00

mvme147.h

…

mvumi.c

SCSI: remove unnecessary pci_set_drvdata()

2013-10-14 15:26:04 +02:00

mvumi.h

[SCSI] mvumi: Use PCI_VENDOR_ID_MARVELL_EXT for 0x1b4b

2013-04-15 14:30:44 -06:00

ncr53c8xx.c

treewide: Fix common typo in "identify"

2013-10-14 15:31:06 +02:00

ncr53c8xx.h

…

NCR53c406a.c

…

NCR5380.c

[SCSI] remove deprecated IRQF_DISABLED from SCSI

2014-03-19 15:04:44 -07:00

NCR5380.h

NCR5830: switch to ->show_info()

2013-04-09 14:13:17 -04:00

NCR_D700.c

Drivers: scsi: remove __dev* attributes.

2013-01-03 15:57:01 -08:00

NCR_D700.h

…

NCR_Q720.c

Drivers: scsi: remove __dev* attributes.

2013-01-03 15:57:01 -08:00

NCR_Q720.h

…

nsp32_debug.c

treewide: fix a few typos in comments

2011-05-10 10:16:21 +02:00

nsp32_io.h

…

nsp32.c

[SCSI] nsp32: use mdelay instead of large udelay constants

2013-06-19 17:53:35 +02:00

nsp32.h

Fix common misspellings

2011-03-31 11:26:23 -03:00

osst_detect.h

…

osst_options.h

…

osst.c

Remove all #inclusions of asm/system.h

2012-03-28 18:30:03 +01:00

osst.h

Fix common misspellings

2011-03-31 11:26:23 -03:00

pas16.c

[SCSI] remove deprecated IRQF_DISABLED from SCSI

2014-03-19 15:04:44 -07:00

pas16.h

NCR5830: switch to ->show_info()

2013-04-09 14:13:17 -04:00

pmcraid.c

SCSI fixes on 20131206

2013-12-06 08:30:18 -08:00

pmcraid.h

scsi: Fix typo in pmcraid.h

2012-02-21 11:40:37 +01:00

ppa.c

ppa: switch to ->show_info()

2013-04-09 14:13:17 -04:00

ppa.h

…

ps3rom.c

Drivers: scsi: remove __dev* attributes.

2013-01-03 15:57:01 -08:00

qla1280.c

x86, platforms: Remove SGI Visual Workstation

2014-02-27 08:07:39 -08:00

qla1280.h

…

qlogicfas408.c

…

qlogicfas408.h

…

qlogicfas.c

Drivers: scsi: remove __dev* attributes.

2013-01-03 15:57:01 -08:00

qlogicpti.c

Drivers: scsi: remove __dev* attributes.

2013-01-03 15:57:01 -08:00

qlogicpti.h

…

raid_class.c

…

script_asm.pl

…

scsi_debug.c

[SCSI] scsi_debug: add ability to enable clustering

2014-03-19 15:04:37 -07:00

scsi_devinfo.c

[SCSI] Workaround for disks that report bad optimal transfer length

2013-06-24 13:00:10 -07:00

scsi_error.c

[SCSI] do not manipulate device reference counts in scsi_get/put_command

2014-03-15 10:19:24 -07:00

scsi_ioctl.c

…

scsi_lib_dma.c

scsi: Add export.h for EXPORT_SYMBOL/THIS_MODULE as required

2011-10-31 19:31:23 -04:00

scsi_lib.c

[SCSI] don't reference freed command in scsi_init_sgtable

2014-04-21 07:57:21 -07:00

scsi_logging.h

…

scsi_module.c

…

scsi_netlink.c

scsi: replace obsolete NLMSG_* with type safe nlmsg_*

2013-03-28 14:27:24 -04:00

scsi_pm.c

scsi: async sd resume

2014-04-10 15:30:35 -07:00

scsi_priv.h

scsi: async sd resume

2014-04-10 15:30:35 -07:00

scsi_proc.c

fix buffer leak after "scsi: saner replacements for ->proc_info()"

2013-05-31 15:16:51 -04:00

scsi_sas_internal.h

…

scsi_scan.c

Merge branch 'async-scsi-resume' of git://git.kernel.org/pub/scm/linux/kernel/git/djbw/isci

2014-04-11 17:23:52 -07:00

scsi_sysctl.c

…

scsi_sysfs.c

SCSI misc on 20140401

2014-04-01 18:49:04 -07:00

scsi_tgt_if.c

scsi: Add export.h for EXPORT_SYMBOL/THIS_MODULE as required

2011-10-31 19:31:23 -04:00

scsi_tgt_lib.c

[SCSI] do not manipulate device reference counts in scsi_get/put_command

2014-03-15 10:19:24 -07:00

scsi_tgt_priv.h

…

scsi_trace.c

[SCSI] scsi_trace: Decode UNMAP bit in WRITE SAME(10)

2011-05-24 12:38:36 -04:00

scsi_transport_api.h

…

scsi_transport_fc_internal.h

…

scsi_transport_fc.c

[SCSI] scsi_transport_fc: Add 32Gbps speed definition.

2014-03-15 10:17:50 -07:00

scsi_transport_iscsi.c

Merge branch 'master' into for-next

2014-02-20 14:54:28 +01:00

scsi_transport_sas.c

[SCSI] scsi_transport_sas: add 12GB definitions for mpt3sas

2012-12-01 10:08:41 +00:00

scsi_transport_spi.c

[SCSI] scsi_transport_spi: fix for unbalanced reference counting

2012-05-10 09:06:12 +01:00

scsi_transport_srp_internal.h

…

scsi_transport_srp.c

scsi_transport_srp: Fix two kernel-doc warnings

2014-03-24 10:05:30 -07:00

scsi_typedefs.h

…

scsi.c

Merge branch 'async-scsi-resume' of git://git.kernel.org/pub/scm/linux/kernel/git/djbw/isci

2014-04-11 17:23:52 -07:00

scsi.h

…

scsicam.c

fs: move code out of buffer.c

2012-01-03 22:54:07 -05:00

sd_dif.c

bio-integrity: Convert to bvec_iter

2013-11-23 22:33:50 -08:00

sd.c

Merge branch 'async-scsi-resume' of git://git.kernel.org/pub/scm/linux/kernel/git/djbw/isci

2014-04-11 17:23:52 -07:00

sd.h

[SCSI] sd: Quiesce mode sense error messages

2014-03-27 08:26:33 -07:00

ses.c

[SCSI] ses: Use vpd information from scsi_device

2014-03-27 08:26:31 -07:00

sg.c

[SCSI] Revert "sg: use rwsem to solve race during exclusive open"

2013-10-25 10:59:54 +01:00

sgiwd93.c

Drivers: scsi: remove __dev* attributes.

2013-01-03 15:57:01 -08:00

sim710.c

Drivers: scsi: remove __dev* attributes.

2013-01-03 15:57:01 -08:00

sni_53c710.c

Drivers: scsi: remove __dev* attributes.

2013-01-03 15:57:01 -08:00

sr_ioctl.c

scsi: Fix up files implicitly depending on module.h inclusion

2011-10-31 19:31:24 -04:00

sr_vendor.c

…

sr.c

[SCSI] sr: use block layer runtime PM

2013-12-16 10:57:51 -08:00

sr.h

[SCSI] sr: check_events() ignore GET_EVENT when TUR says otherwise

2011-07-21 14:15:58 -07:00

st_options.h

…

st.c

[SCSI] st: fix corruption of the st_modedef structures in st_set_options()

2014-03-15 10:19:22 -07:00

st.h

[SCSI] st: raise device limit

2012-09-14 17:59:29 +01:00

stex.c

SCSI: remove unnecessary pci_set_drvdata()

2013-10-14 15:26:04 +02:00

storvsc_drv.c

[SCSI] storvsc: NULL pointer dereference fix

2014-03-12 13:16:54 +04:00

sun3_NCR5380.c

sun3_scsi: add ->show_info()

2013-05-04 14:50:16 -04:00

sun3_scsi_vme.c

Remove all #inclusions of asm/system.h

2012-03-28 18:30:03 +01:00

sun3_scsi.c

sun3_scsi: add ->show_info()

2013-05-04 14:50:16 -04:00

sun3_scsi.h

sun3_scsi: add ->show_info()

2013-05-04 14:50:16 -04:00

sun3x_esp.c

Drivers: scsi: remove __dev* attributes.

2013-01-03 15:57:01 -08:00

sun_esp.c

Drivers: scsi: remove __dev* attributes.

2013-01-03 15:57:01 -08:00

sym53c416.c

Drivers: scsi: remove __dev* attributes.

2013-01-03 15:57:01 -08:00

sym53c416.h

…

t128.c

[SCSI] remove deprecated IRQF_DISABLED from SCSI

2014-03-19 15:04:44 -07:00

t128.h

NCR5830: switch to ->show_info()

2013-04-09 14:13:17 -04:00

tmscsim.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial

2013-11-15 16:47:22 -08:00

tmscsim.h

[SCSI] tmscsim: Move 'last_reset' into host structure

2013-10-25 11:51:37 +01:00

u14-34f.c

[SCSI] remove deprecated IRQF_DISABLED from SCSI

2014-03-19 15:04:44 -07:00

ultrastor.c

Remove all #inclusions of asm/system.h

2012-03-28 18:30:03 +01:00

ultrastor.h

…

virtio_scsi.c

virtio-scsi: Fix hotcpu_notifier use-after-free with virtscsi_freeze

2014-01-16 10:22:27 +10:30

vmw_pvscsi.c

[SCSI] vmw_pvscsi: Some improvements in pvscsi driver.

2014-03-19 15:04:46 -07:00

vmw_pvscsi.h

[SCSI] vmw_pvscsi: Some improvements in pvscsi driver.

2014-03-19 15:04:46 -07:00

wd33c93.c

switch wd33c93 to ->show_info()

2013-04-09 14:13:15 -04:00

wd33c93.h

switch wd33c93 to ->show_info()

2013-04-09 14:13:15 -04:00

wd7000.c

[SCSI] remove deprecated IRQF_DISABLED from SCSI

2014-03-19 15:04:44 -07:00

zalon.c

Drivers: scsi: remove __dev* attributes.

2013-01-03 15:57:01 -08:00

zorro7xx.c

zorro: ZTWO_VADDR() should return "void __iomem *"

2013-11-26 11:09:07 +01:00