On Mon, May 25, 2020 at 11:11:38AM +0200, Bodo Stroesser wrote:
> On 05/23/20 12:11, Dan Carpenter wrote:
> > The pr_debug() dereferences "cmd" after we already freed it by calling
> > tcmu_free_cmd(cmd). The debug printk needs to be done earlier.
> >
> > Fixes: 61fb24822166 ("scsi: target: tcmu: Userspace must not complete queued commands")
> > Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
> > ---
> > drivers/target/target_core_user.c | 6 +++---
> > 1 file changed, 3 insertions(+), 3 deletions(-)
> >
>
> Thank you.
>
> I'm very sorry for this stupid bug.
Bugs like this are super common. Part of being human. It would have
been hard to discover via testing because you have disable memory
poisoning on free and debugging at the same time.
regards,
dan carpenter
