diff options
| author | Paolo Bonzini <[email protected]> | 2012-09-05 15:09:15 +0000 |
|---|---|---|
| committer | Nicholas Bellinger <[email protected]> | 2012-09-06 00:20:28 +0000 |
| commit | d5829eac5f7cfff89c6d1cf11717eee97cf030d0 (patch) | |
| tree | 9acff1b99c654235b5ad4534735fdaf03a9c5a45 /lib/dynamic_debug.c | |
| parent | target: simplify code around transport_get_sense_data (diff) | |
| download | kernel-d5829eac5f7cfff89c6d1cf11717eee97cf030d0.tar.gz kernel-d5829eac5f7cfff89c6d1cf11717eee97cf030d0.zip | |
target: fix use-after-free with PSCSI sense data
The pointer to the sense buffer is fetched by transport_get_sense_data,
but this is called by target_complete_ok_work long after pscsi_req_done
has freed the struct that contains it.
Pass instead the fabric's sense buffer to transport_complete,
and copy the data to it directly in transport_complete. Setting
SCF_TRANSPORT_TASK_SENSE also becomes a duty of transport_complete.
Signed-off-by: Paolo Bonzini <[email protected]>
Cc: [email protected]
Signed-off-by: Nicholas Bellinger <[email protected]>
Diffstat (limited to 'lib/dynamic_debug.c')
0 files changed, 0 insertions, 0 deletions