• Nicholas Bellinger's avatar
    tcm_fc: Fix free-after-use regression in ft_free_cmd · ed8ec8f7
    Nicholas Bellinger authored
    This patch fixes a free-after-use regression in ft_free_cmd(), where
    ft_sess_put() is called with cmd->sess after percpu_ida_free() has
    already released the tag.
    
    Fix this bug by saving the ft_sess pointer ahead of percpu_ida_free(),
    and pass it directly to ft_sess_put().
    
    The regression was originally introduced in v3.13-rc1 commit:
    
      commit 5f544cfa
      Author: Nicholas Bellinger <nab@daterainc.com>
      Date:   Mon Sep 23 12:12:42 2013 -0700
    
          tcm_fc: Convert to per-cpu command map pre-allocation of ft_cmd
    Reported-by: default avatarJun Wu <jwu@stormojo.com>
    Cc: Mark Rustad <mark.d.rustad@intel.com>
    Cc: Robert Love <robert.w.love@intel.com>
    Cc: <stable@vger.kernel.org> #3.13+
    Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
    ed8ec8f7
tfc_cmd.c 14 KB