From: Daniel Gryniewicz <dang@linuxbox.com>
Date: Tue, 16 Sep 2014 14:41:13 +0000 (-0400)
Subject: [SCSI] fix for bidi use after free
X-Git-Tag: fixes-for-v3.18-merge-window~103^2
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f81426a84bef870d26e5e752772d8ca203cd4aed;p=pandora-kernel.git

[SCSI] fix for bidi use after free

When ending a bi-directionional SCSI request, blk_finish_request()
cleans up and frees the request, but scsi_release_bidi_buffers() tries
to indirect through the request to find it's data buffers.  This causes
a panic due to a null pointer dereference.

Move the call to scsi_release_bidi_buffers() before the call to
blk_finish_request().

Signed-off-by: Daniel Gryniewicz <dang@linuxbox.com>
Reviewed-by: Webb Scales <webbnh@hp.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
---

Reading git-diff-tree failed