On Fri, 11 Mar 2022 21:22:05 +0800, Xiaoguang Wang wrote:
> tcmu_try_get_data_page() looks up pages under cmdr_lock, but it don't
> take refcount properly and just return page pointer.
>
> When tcmu_try_get_data_page() returns, the returned page may have been
> freed by tcmu_blocks_release(), need to get_page() under cmdr_lock to
> avoid concurrent tcmu_blocks_release().
>
> [...]
Applied to 5.18/scsi-fixes, thanks!
[1/2] scsi: target: tcmu: Fix possible page UAF
https://git.kernel.org/mkp/scsi/c/a6968f7a367f
--
Martin K. Petersen Oracle Linux Engineering
