From: Paolo Bonzini Date: Wed, 5 Sep 2012 15:09:15 +0000 (+0200) Subject: target: fix use-after-free with PSCSI sense data X-Git-Tag: v3.6-rc6~3^2~6 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d5829eac5f7cfff89c6d1cf11717eee97cf030d0;p=pandora-kernel.git target: fix use-after-free with PSCSI sense data The pointer to the sense buffer is fetched by transport_get_sense_data, but this is called by target_complete_ok_work long after pscsi_req_done has freed the struct that contains it. Pass instead the fabric's sense buffer to transport_complete, and copy the data to it directly in transport_complete. Setting SCF_TRANSPORT_TASK_SENSE also becomes a duty of transport_complete. Signed-off-by: Paolo Bonzini Cc: stable@vger.kernel.org Signed-off-by: Nicholas Bellinger --- Reading git-diff-tree failed