Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 40d883b0 authored by Xiubo Li's avatar Xiubo Li Committed by Martin K. Petersen
Browse files

scsi: tcmu: fix use after free 



Fixes: a94a2572 ("scsi: tcmu: avoid cmd/qfull timers updated whenever a new cmd comes")
Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Cc: Mike Christie <mchristi@redhat.com>
Signed-off-by: default avatarXiubo Li <xiubli@redhat.com>
Reviewed-by: default avatarMike Christie <mchristi@redhat.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent fe35a40e

drivers/target/target_core_user.c

+2 −1
Original line number Diff line number Diff line
@@ -1317,12 +1317,13 @@ static int tcmu_check_expired_cmd(int id, void *p, void *data) 
		 * target_complete_cmd will translate this to LUN COMM FAILURE

		 */

		scsi_status = SAM_STAT_CHECK_CONDITION;

		list_del_init(&cmd->queue_entry);

	} else {

		list_del_init(&cmd->queue_entry);

		idr_remove(&udev->commands, id);

		tcmu_free_cmd(cmd);

		scsi_status = SAM_STAT_TASK_SET_FULL;

	}

	list_del_init(&cmd->queue_entry);



	pr_debug("Timing out cmd %u on dev %s that is %s.\n",

		 id, udev->name, is_running ? "inflight" : "queued");