On 24/05/17 01:48, Bart Van Assche wrote: > scsiback_release_cmd() must not dereference se_cmd->se_tmr_req > because that memory is freed by target_free_cmd_mem() before > scsiback_release_cmd() is called. Fix this use-after-free by > inlining struct scsiback_tmr into struct vscsibk_pend. > > Signed-off-by: Bart Van Assche <bart.vanassche@xxxxxxxxxxx> > Cc: Juergen Gross <jgross@xxxxxxxx> > Cc: Christoph Hellwig <hch@xxxxxx> > Cc: Hannes Reinecke <hare@xxxxxxxx> > Cc: David Disseldorp <ddiss@xxxxxxx> > Cc: xen-devel@xxxxxxxxxxxxxxxxxxxx Reviewed-by: Juergen Gross <jgross@xxxxxxxx> Juergen -- To unsubscribe from this list: send the line "unsubscribe target-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
