summaryrefslogtreecommitdiffstats
path: root/include/scsi
diff options
context:
space:
mode:
authorBart Van Assche <bart.vanassche@sandisk.com>2017-06-02 14:21:52 -0700
committerMartin K. Petersen <martin.petersen@oracle.com>2017-06-12 20:55:58 -0400
commit8e6882545d8c06f99e9e117741cc87f3338b0bef (patch)
tree12a6bb40ee60e460788b3b45cddce7326dba6a4f /include/scsi
parent896f6966fc815abe71f85fb26f0193875df8a035 (diff)
downloadlinux-stable-8e6882545d8c06f99e9e117741cc87f3338b0bef.tar.gz
linux-stable-8e6882545d8c06f99e9e117741cc87f3338b0bef.tar.bz2
linux-stable-8e6882545d8c06f99e9e117741cc87f3338b0bef.zip
scsi: Avoid that scsi_exit_rq() triggers a use-after-free
Dereferencing shost from scsi_exit_rq() is not safe because the SCSI host may already have been freed when scsi_exit_rq() is called. Increasing the shost reference count in scsi_init_rq() and dropping that reference in scsi_exit_rq() is nontrivial since scsi_host_dev_release() may sleep and since scsi_exit_rq() may be called from interrupt context. Since scsi_exit_rq() only needs a single bit from shost, copy that bit into struct scsi_cmnd. Reported-by: Scott Bauer <scott.bauer@intel.com> Fixes: e9c787e65c0c ("scsi: allocate scsi_cmnd structures as part of struct request") Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Cc: Hannes Reinecke <hare@suse.com> Cc: Scott Bauer <scott.bauer@intel.com> Cc: Jan Kara <jack@suse.cz> Cc: <stable@vger.kernel.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Diffstat (limited to 'include/scsi')
-rw-r--r--include/scsi/scsi_cmnd.h1
1 files changed, 1 insertions, 0 deletions
diff --git a/include/scsi/scsi_cmnd.h b/include/scsi/scsi_cmnd.h
index b379f93a2c48..16351de31243 100644
--- a/include/scsi/scsi_cmnd.h
+++ b/include/scsi/scsi_cmnd.h
@@ -56,6 +56,7 @@ struct scsi_pointer {
/* for scmd->flags */
#define SCMD_TAGGED (1 << 0)
+#define SCMD_UNCHECKED_ISA_DMA (1 << 1)
struct scsi_cmnd {
struct scsi_request req;