This is a note to let you know that I've just added the patch titled
target: fix use after free in target_report_luns
to the 3.2-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
target-fix-use-after-free-in-target_report_luns.patch
and it can be found in the queue-3.2 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <[email protected]> know about it.
>From 382436f8804fe1cb20b9a2a811a10eb2d8554721 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rn=20Engel?= <[email protected]>
Date: Wed, 15 Feb 2012 16:51:32 -0500
Subject: target: fix use after free in target_report_luns
From: =?UTF-8?q?J=C3=B6rn=20Engel?= <[email protected]>
commit 382436f8804fe1cb20b9a2a811a10eb2d8554721 upstream.
Fix possible NULL pointer dereference in target_report_luns failure path.
Signed-off-by: Joern Engel <[email protected]>
Signed-off-by: Nicholas Bellinger <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/target/target_core_device.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -696,12 +696,12 @@ int target_report_luns(struct se_task *s
* See SPC3 r07, page 159.
*/
done:
- transport_kunmap_data_sg(se_cmd);
lun_count *= 8;
buf[0] = ((lun_count >> 24) & 0xff);
buf[1] = ((lun_count >> 16) & 0xff);
buf[2] = ((lun_count >> 8) & 0xff);
buf[3] = (lun_count & 0xff);
+ transport_kunmap_data_sg(se_cmd);
se_task->task_scsi_status = GOOD;
transport_complete_task(se_task, 1);
Patches currently in stable-queue which might be from [email protected] are
queue-3.2/target-fix-use-after-free-in-target_report_luns.patch
queue-3.2/target-prevent-null-pointer-dereference-in-target_report_luns.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
