From: Lv Yunlong Date: Thu, 11 Mar 2021 06:46:36 +0000 (-0800) Subject: scsi: st: Fix a use after free in st_open() X-Git-Tag: v4.4.265~21 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9ccfca0f00fbc8bb20a668fe7ba21f8ea3cc9199;p=thirdparty%2Fkernel%2Fstable.git scsi: st: Fix a use after free in st_open() [ Upstream commit c8c165dea4c8f5ad67b1240861e4f6c5395fa4ac ] In st_open(), if STp->in_use is true, STp will be freed by scsi_tape_put(). However, STp is still used by DEBC_printk() after. It is better to DEBC_printk() before scsi_tape_put(). Link: https://lore.kernel.org/r/20210311064636.10522-1-lyl2019@mail.ustc.edu.cn Acked-by: Kai Mäkisara Signed-off-by: Lv Yunlong Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin --- diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c index 088a68ab4246b..3a3876091a9d1 100644 --- a/drivers/scsi/st.c +++ b/drivers/scsi/st.c @@ -1267,8 +1267,8 @@ static int st_open(struct inode *inode, struct file *filp) spin_lock(&st_use_lock); if (STp->in_use) { spin_unlock(&st_use_lock); - scsi_tape_put(STp); DEBC_printk(STp, "Device already in use.\n"); + scsi_tape_put(STp); return (-EBUSY); }