tree c5603336cb7682e5aa965e5acba854ed827b9f62
parent cdebec5e40bd0af82da0659f37af85ee2aa2c9d1
author Paolo Bonzini <pbonzini@redhat.com> 1412723940 +0200
committer Paolo Bonzini <pbonzini@redhat.com> 1412861775 +0200

virtio-scsi: fix use-after-free of VirtIOSCSIReq

scsi_req_continue can complete the request and cause the VirtIOSCSIReq
to be freed.  Fetch req->sreq just once to avoid the bug.

Reported-by: Richard Jones <rjones@redhat.com>
Tested-by: Richard Jones <rjones@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>