Re: [PATCH] Fix panic from use after free in qla2x00_async_tm_cmd

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 




On 2/12/19, 6:30 AM, "Bill Kuzeja" <William.Kuzeja@xxxxxxxxxxx> wrote:

    External Email
    
    ---
    In qla2x00_async_tm_cmd, we reference off sp after it has been freed.
    This caused a panic on a system running a slub debug kernel. Since
    fcport is passed in anyways, just use that instead.
    
    Signed-off-by: Bill Kuzeja <william.kuzeja@xxxxxxxxxxx>
    ---
     drivers/scsi/qla2xxx/qla_init.c | 4 ++--
     1 file changed, 2 insertions(+), 2 deletions(-)
    
    diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
    index aeeb014..8d1acc8 100644
    --- a/drivers/scsi/qla2xxx/qla_init.c
    +++ b/drivers/scsi/qla2xxx/qla_init.c
    @@ -1785,13 +1785,13 @@ void qla_rscn_replay(fc_port_t *fcport)
    
                    /* Issue Marker IOCB */
                    qla2x00_marker(vha, vha->hw->req_q_map[0],
    -                   vha->hw->rsp_q_map[0], sp->fcport->loop_id, lun,
    +                   vha->hw->rsp_q_map[0], fcport->loop_id, lun,
                        flags == TCF_LUN_RESET ? MK_SYNC_ID_LUN : MK_SYNC_ID);
            }
    
     done_free_sp:
            sp->free(sp);
    -       sp->fcport->flags &= ~FCF_ASYNC_SENT;
    +       fcport->flags &= ~FCF_ASYNC_SENT;
     done:
            return rval;
     }
    --
    1.8.3.1
    
Looks good. 

Acked-by: Himanshu Madhani <hmadhani@xxxxxxxxxxx>





[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [SCSI Target Devel]     [Linux SCSI Target Infrastructure]     [Kernel Newbies]     [IDE]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux ATA RAID]     [Linux IIO]     [Samba]     [Device Mapper]

  Powered by Linux