Re: [PATCH] xen/scsifront: check for a NULL shadow entry on a backend response

["Martin K. Petersen (Oracle)" <mkp@xxxxxxxxxx>]

On Mon, 05 Oct 2026 21:35:54 +0900, Yehyeong Lee wrote:

> scsifront_do_response() validates the rqid in a backend response against
> VSCSIIF_MAX_REQS before using it to index info->shadow[], but then
> dereferences the entry to test ->inflight without checking that the slot
> is populated.  Shadow slots are NULL before a command is submitted (the
> host private area is zeroed at allocation) and are reset to NULL in
> _scsifront_put_rqid() once a request completes, so an in-range rqid that
> does not correspond to an outstanding request makes the frontend
> dereference a NULL pointer.
> 
> [...]

Applied to 7.3/scsi-fixes, thanks!

[1/1] xen/scsifront: check for a NULL shadow entry on a backend response
      https://git.kernel.org/mkp/scsi/c/8c8222c25577

-- 
Martin K. Petersen