Kernel/linux-next
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git synced 2025-01-10 07:50:04 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

tcmu: fix cmd user after free

Browse Source 
If we are failing the command due to a qfull timeout we are
also freeing the tcmu command, so we cannot access it later
to get the se_cmd.

Note: The clearing of cmd->se_cmd is not needed. We do not check
it later for something like determining if the command was failed
due to a timeout. As a result I am dropping it.

Signed-off-by: Mike Christie <mchristi@redhat.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
This commit is contained in:
Mike Christie 2018-01-15 14:37:59 -06:00 committed by Nicholas Bellinger
parent c82b59e7c3
commit 45dc488c0e
1 changed files with 1 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/target/target_core_user.c
View File

@ -1152,6 +1152,7 @@ static int tcmu_check_expired_cmd(int id, void *p, void *data)
return 0;
is_running = list_empty(&cmd->cmdr_queue_entry);
se_cmd = cmd->se_cmd;
if (is_running) {
/*
@ -1177,8 +1178,6 @@ static int tcmu_check_expired_cmd(int id, void *p, void *data)
pr_debug("Timing out cmd %u on dev %s that is %s.\n",
id, udev->name, is_running ? "inflight" : "queued");
se_cmd = cmd->se_cmd;
cmd->se_cmd = NULL;
target_complete_cmd(se_cmd, scsi_status);
return 0;
}