From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 4 May 2012 10:32:04 +0000 (+0200)
Subject: [SCSI] virtio_scsi: fix TMF use-after-free
X-Git-Tag: v3.4-rc7~3^2
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e4594bb50518eb89c447be97dabd5bd99f405d71;p=pandora-kernel.git

[SCSI] virtio_scsi: fix TMF use-after-free

Fix a use-after-free in the TMF path, where cmd may have been already
freed by virtscsi_complete_free when wait_for_completion restarts
executing virtscsi_tmf.  Technically a race, but in practice the command
will always be freed long before the completion waiter is awoken.

The fix is to make callers specifying a completion responsible for
freeing the command in all cases.

Signed-off-by: Hu Tao <hutao@cn.fujitsu.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
---

Reading git-diff-tree failed