On Tue, 2013-04-02 at 18:39 +0300, Michael S. Tsirkin wrote:
> On Tue, Apr 02, 2013 at 11:31:37PM +0800, Asias He wrote:
> > In vhost_scsi_handle_vq:
> >
> > tv_tpg = vs->vs_tpg[target];
> > if (!tv_tpg) {
> >
> > return
> > }
> >
> > tv_cm
On Tue, Apr 02, 2013 at 11:31:37PM +0800, Asias He wrote:
> In vhost_scsi_handle_vq:
>
> tv_tpg = vs->vs_tpg[target];
> if (!tv_tpg) {
>
> return
> }
>
> tv_cmd = vhost_scsi_allocate_cmd(tv_tpg, &v_req,
>
> 1) vs->vs_tpg[target] might chan
In vhost_scsi_handle_vq:
tv_tpg = vs->vs_tpg[target];
if (!tv_tpg) {
return
}
tv_cmd = vhost_scsi_allocate_cmd(tv_tpg, &v_req,
1) vs->vs_tpg[target] might change after the NULL check and 2) the above
line might access tv_tpg from vs->vs_tp
