[SCSI] fix use-after-free in scsi_init_io()
authorJames Bottomley <James.Bottomley@suse.de>
Mon, 16 Aug 2010 15:06:26 +0000 (10:06 -0500)
committerJames Bottomley <James.Bottomley@suse.de>
Thu, 9 Sep 2010 14:58:18 +0000 (09:58 -0500)
we're using a pointer through a freed command to reset the request,
which has shown up as an oops with slab poisoning:

Reported-by: Tejun Heo <tj@kernel.org>
Reported-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>
drivers/scsi/scsi_lib.c

index 9ade720..ee02d38 100644 (file)
@@ -1011,8 +1011,8 @@ int scsi_init_io(struct scsi_cmnd *cmd, gfp_t gfp_mask)
 
 err_exit:
        scsi_release_buffers(cmd);
-       scsi_put_command(cmd);
        cmd->request->special = NULL;
+       scsi_put_command(cmd);
        return error;
 }
 EXPORT_SYMBOL(scsi_init_io);