Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 40be67f4 authored by Nicholas Bellinger's avatar Nicholas Bellinger
Browse files

target: Fix possible NULL pointer with __transport_execute_tasks 



This patch makes __transport_execute_tasks() use a local *se_dev
reference to prevent direct se_cmd->se_dev access after
transport_cmd_check_stop() -> transport_add_tasks_from_cmd()
has been called, as in the current implementation we can expect
__transport_execute_tasks() may be called from another context
that may have already completed the I/O.

Cc: Christoph Hellwig <hch@lst.de>
Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
parent ec54cc08

drivers/target/target_core_transport.c

+2 −1
Original line number Original line Diff line number Diff line
@@ -2076,6 +2076,7 @@ static inline int transport_execute_task_attr(struct se_cmd *cmd) 
static int transport_execute_tasks(struct se_cmd *cmd)

static int transport_execute_tasks(struct se_cmd *cmd)

{

{

	int add_tasks;

	int add_tasks;

	struct se_device *se_dev = cmd->se_dev;





	if (se_dev_check_online(cmd->se_dev) != 0) {

	if (se_dev_check_online(cmd->se_dev) != 0) {

		cmd->scsi_sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;

		cmd->scsi_sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
@@ -2108,7 +2109,7 @@ static int transport_execute_tasks(struct se_cmd *cmd) 
	 * storage object.

	 * storage object.

	 */

	 */

execute_tasks:

execute_tasks:

	__transport_execute_tasks(cmd->se_dev);

	__transport_execute_tasks(se_dev);

	return 0;

	return 0;

}

}