Files
linux/drivers
Paolo Bonzini d5829eac5f target: fix use-after-free with PSCSI sense data
The pointer to the sense buffer is fetched by transport_get_sense_data,
but this is called by target_complete_ok_work long after pscsi_req_done
has freed the struct that contains it.

Pass instead the fabric's sense buffer to transport_complete,
and copy the data to it directly in transport_complete.  Setting
SCF_TRANSPORT_TASK_SENSE also becomes a duty of transport_complete.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2012-09-05 17:20:28 -07:00
..
2012-08-02 13:51:46 -04:00
2012-08-04 12:15:39 +04:00
2012-08-13 10:15:22 +05:30
2012-07-29 21:11:05 -03:00
2012-07-15 17:33:17 +01:00
2012-08-06 18:10:04 +02:00
2012-08-13 14:34:02 +08:00
2012-08-12 13:42:18 -07:00
2012-08-10 12:27:47 +02:00
2012-07-31 08:16:24 -06:00
2012-07-31 08:16:22 -06:00
2012-07-31 08:16:22 -06:00