diff options
| author | Bart Van Assche <bvanassche@acm.org> | 2012-06-29 19:34:26 +0400 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2012-08-02 17:37:55 +0400 |
| commit | 09411e4280933eb335e1f723dc215a5583c3be8f (patch) | |
| tree | b25cd89a6afb842080448cb93e3b1a42cad1c40c /drivers/scsi/scsi_scan.c | |
| parent | 9c63d964e3f093b858a6f06875a68bc4206f71ba (diff) | |
| download | linux-09411e4280933eb335e1f723dc215a5583c3be8f.tar.xz | |
Avoid dangling pointer in scsi_requeue_command()
commit 940f5d47e2f2e1fa00443921a0abf4822335b54d upstream.
When we call scsi_unprep_request() the command associated with the request
gets destroyed and therefore drops its reference on the device. If this was
the only reference, the device may get released and we end up with a NULL
pointer deref when we call blk_requeue_request.
Reported-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Mike Christie <michaelc@cs.wisc.edu>
Reviewed-by: Tejun Heo <tj@kernel.org>
[jejb: enhance commend and add commit log for stable]
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'drivers/scsi/scsi_scan.c')
0 files changed, 0 insertions, 0 deletions