On 03/06/17 09:04, Nicholas A. Bellinger wrote: > On Fri, 2017-06-02 at 22:40 -0700, Nicholas A. Bellinger wrote: >> On Tue, 2017-05-23 at 16:48 -0700, Bart Van Assche wrote: >>> scsiback_release_cmd() must not dereference se_cmd->se_tmr_req >>> because that memory is freed by target_free_cmd_mem() before >>> scsiback_release_cmd() is called. Fix this use-after-free by >>> inlining struct scsiback_tmr into struct vscsibk_pend. >>> >>> Signed-off-by: Bart Van Assche <bart.vanass...@sandisk.com> >>> Cc: Juergen Gross <jgr...@suse.com> >>> Cc: Christoph Hellwig <h...@lst.de> >>> Cc: Hannes Reinecke <h...@suse.com> >>> Cc: David Disseldorp <dd...@suse.de> >>> Cc: xen-de...@lists.xenproject.org >>> --- >>> drivers/xen/xen-scsiback.c | 33 +++++++++------------------------ >>> 1 file changed, 9 insertions(+), 24 deletions(-) >> >> Applied. >> > > Oh btw, this looks like stable material to me. > > So unless Juergen has any objections, adding a v3.18+ tag.
No objections from me. Juergen _______________________________________________ Xen-devel mailing list Xen-devel@lists.xen.org https://lists.xen.org/xen-devel
