lkml.org 
[lkml]   [2012]   [May]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH for 3.4] virtio-scsi: fix TMF use-after-free
Il 18/04/2012 16:09, James Bottomley ha scritto:
>> > Fix a race in TMF path, where cmd may have been already freed
>> > by virtscsi_complete_free after waking up from the completion.
> There's no may about this; the command will be freed long before the
> completion waiter is awoken. The description could be clearer.
>
> The problem is a use after free in virtscsi_tmf because the
> virtio_scsi_command is freed before the completion returns.
>
> The fix is to make callers specifying a completion responsible for
> freeing the command in all cases.

I don't see this in the pull request, were you waiting for v2 with a
better commit message?

Paolo


\
 
 \ /
  Last update: 2012-05-01 10:21    [W:0.190 / U:0.280 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site