iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
d0905ca757
linux/drivers/target
History
Andy Grover d0905ca757 target/user: Fix use-after-free of tcmu_cmds if they are expired 
Don't free the cmd in tcmu_check_expired_cmd, it's still referenced by
an entry in our cmd_id->cmd idr. If userspace ever resumes processing,
tcmu_handle_completions() will use the now-invalid cmd pointer.

Instead, don't free cmd. It will be freed by tcmu_handle_completion() if
userspace ever recovers, or tcmu_free_device if not.

Cc: stable@vger.kernel.org
Reported-by: Bryant G Ly <bgly@us.ibm.com>
Tested-by: Bryant G Ly <bgly@us.ibm.com>
Signed-off-by: Andy Grover <agrover@redhat.com>
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
2016-12-15 16:34:58 +01:00
..
iscsi target: Minimize #include directives 2016-12-09 10:22:28 -08:00
loopback target: Minimize #include directives 2016-12-09 10:22:28 -08:00
sbp sbp-target: Add an #include directive 2016-12-09 10:20:10 -08:00
tcm_fc target: Minimize #include directives 2016-12-09 10:22:28 -08:00
Kconfig target: Put TCMU under a new config option 2015-04-19 22:41:12 -07:00
Makefile target: Put TCMU under a new config option 2015-04-19 22:41:12 -07:00
target_core_alua.c target: Minimize #include directives 2016-12-09 10:22:28 -08:00
target_core_alua.h target: Minimize #include directives 2016-12-09 10:22:28 -08:00
target_core_configfs.c target: Use NULL instead of 0 to represent a pointer 2016-12-09 10:20:01 -08:00
target_core_device.c target: Minimize #include directives 2016-12-09 10:22:28 -08:00
target_core_fabric_configfs.c target: add a new add_wwn_groups fabrics method 2016-03-30 20:06:44 -07:00
target_core_fabric_lib.c Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending 2015-07-04 14:13:43 -07:00
target_core_file.c target: Minimize #include directives 2016-12-09 10:22:28 -08:00
target_core_file.h target: Minimize #include directives 2016-12-09 10:22:28 -08:00
target_core_hba.c target: Fix target_sense_desc_format NULL pointer dereference 2015-09-24 23:17:23 -07:00
target_core_iblock.c target: iblock_execute_sync_cache() should use bio_set_op_attrs() 2016-08-07 14:41:02 -06:00
target_core_iblock.h target: Minimize #include directives 2016-12-09 10:22:28 -08:00
target_core_internal.h target: Minimize #include directives 2016-12-09 10:22:28 -08:00
target_core_pr.c target: Minimize #include directives 2016-12-09 10:22:28 -08:00
target_core_pr.h target: Minimize #include directives 2016-12-09 10:22:28 -08:00
target_core_pscsi.c target: stop using blk_make_request 2016-07-20 17:38:33 -06:00
target_core_pscsi.h target: Minimize #include directives 2016-12-09 10:22:28 -08:00
target_core_rd.c target: Minimize #include directives 2016-12-09 10:22:28 -08:00
target_core_rd.h target: Minimize #include directives 2016-12-09 10:22:28 -08:00
target_core_sbc.c target: Minimize #include directives 2016-12-09 10:22:28 -08:00
target_core_spc.c target: Remove enum transport_lunflags_table 2016-03-10 21:48:55 -08:00
target_core_stat.c configfs: switch ->default groups to a linked list 2016-03-06 16:11:24 +01:00
target_core_tmr.c target: Drop incorrect ABORT_TASK put for completed commands 2016-03-05 20:24:47 -08:00
target_core_tpg.c target: remove sess_kref and ->shutdown_session 2016-05-10 01:19:49 -07:00
target_core_transport.c target: fix potential race window in target_sess_cmd_list_waiting() 2016-10-21 01:19:41 -07:00
target_core_ua.c Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending 2015-07-04 14:13:43 -07:00
target_core_ua.h target: Minimize #include directives 2016-12-09 10:22:28 -08:00
target_core_user.c target/user: Fix use-after-free of tcmu_cmds if they are expired 2016-12-15 16:34:58 +01:00
target_core_xcopy.c target: Minimize #include directives 2016-12-09 10:22:28 -08:00
target_core_xcopy.h target: Minimize #include directives 2016-12-09 10:22:28 -08:00