[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Xen-devel] [PATCH 15/33] xen/scsiback: Fix a use-after-free



On Fri, 2017-06-02 at 22:40 -0700, Nicholas A. Bellinger wrote:
> On Tue, 2017-05-23 at 16:48 -0700, Bart Van Assche wrote:
> > scsiback_release_cmd() must not dereference se_cmd->se_tmr_req
> > because that memory is freed by target_free_cmd_mem() before
> > scsiback_release_cmd() is called. Fix this use-after-free by
> > inlining struct scsiback_tmr into struct vscsibk_pend.
> > 
> > Signed-off-by: Bart Van Assche <bart.vanassche@xxxxxxxxxxx>
> > Cc: Juergen Gross <jgross@xxxxxxxx>
> > Cc: Christoph Hellwig <hch@xxxxxx>
> > Cc: Hannes Reinecke <hare@xxxxxxxx>
> > Cc: David Disseldorp <ddiss@xxxxxxx>
> > Cc: xen-devel@xxxxxxxxxxxxxxxxxxxx
> > ---
> >  drivers/xen/xen-scsiback.c | 33 +++++++++------------------------
> >  1 file changed, 9 insertions(+), 24 deletions(-)
> 
> Applied.
> 

Oh btw, this looks like stable material to me.

So unless Juergen has any objections, adding a v3.18+ tag.


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
https://lists.xen.org/xen-devel

 


Rackspace

Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.