From 25163da6411dad5ebca2927cd44ac59786d753d4 Mon Sep 17 00:00:00 2001 From: Bart Van Assche Date: Mon, 18 Mar 2019 01:01:42 +0000 Subject: [PATCH] iscsi-scst: Fix a use-after-free (merge r8056 from trunk) git-svn-id: http://svn.code.sf.net/p/scst/svn/branches/3.3.x@8058 d57e44dd-8a1f-0410-8b47-8ef2f437770f --- iscsi-scst/kernel/nthread.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/iscsi-scst/kernel/nthread.c b/iscsi-scst/kernel/nthread.c index a6aba9d3d..90b4a3c62 100644 --- a/iscsi-scst/kernel/nthread.c +++ b/iscsi-scst/kernel/nthread.c @@ -1426,7 +1426,8 @@ retry: #if defined(CONFIG_TCP_ZERO_COPY_TRANSFER_COMPLETION_NOTIFICATION) sock_sendpage = sock->ops->sendpage; #else - if ((write_cmnd->parent_req->scst_cmd != NULL) && + if (write_cmnd->parent_req->scst_cmd && + write_cmnd->parent_req->scst_state != ISCSI_CMD_STATE_AEN && scst_cmd_get_dh_data_buff_alloced(write_cmnd->parent_req->scst_cmd)) sock_sendpage = sock_no_sendpage; else