diff options
| author | Pan Bian <bianpan2016@163.com> | 2017-08-08 14:40:30 +0300 |
|---|---|---|
| committer | Martin K. Petersen <martin.petersen@oracle.com> | 2017-08-11 02:55:35 +0300 |
| commit | bc1371c181b503fe925ae292cd96618f305790cd (patch) | |
| tree | 5992e86ed76195b4ff9e05afa92e9960c5a1f4fa /drivers/scsi/pm8001 | |
| parent | 3b8328e2e0fda49202b502154608dd6fb8e8ed37 (diff) | |
| download | linux-bc1371c181b503fe925ae292cd96618f305790cd.tar.xz | |
scsi: pm8001: fix double free in pm8001_pci_probe
In function pm8001_pci_probe(), on errors that the control flow jumps to
label err_out_ha_free, function pm8001_free() is called. In pm8001_free(),
scsi_host_put() is called to release shost, which keeps the return value
of scsi_host_alloc(). After pm8001_free() returns, kfree() is called to
free shost again, resulting in a double free bug. This patch removes
scsi_host_put() from pm8001_free() and explicitly calls scsi_host_put()
to release Scsi_Host in need.
Signed-off-by: Pan Bian <bianpan2016@163.com>
Reviewed-by: Jack Wang <jinpu.wang@profitbricks.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Diffstat (limited to 'drivers/scsi/pm8001')
| -rw-r--r-- | drivers/scsi/pm8001/pm8001_init.c | 5 |
1 files changed, 2 insertions, 3 deletions
diff --git a/drivers/scsi/pm8001/pm8001_init.c b/drivers/scsi/pm8001/pm8001_init.c index 034b2f7d1135..2908881bad51 100644 --- a/drivers/scsi/pm8001/pm8001_init.c +++ b/drivers/scsi/pm8001/pm8001_init.c @@ -160,8 +160,6 @@ static void pm8001_free(struct pm8001_hba_info *pm8001_ha) } } PM8001_CHIP_DISP->chip_iounmap(pm8001_ha); - if (pm8001_ha->shost) - scsi_host_put(pm8001_ha->shost); flush_workqueue(pm8001_wq); kfree(pm8001_ha->tags); kfree(pm8001_ha); @@ -1073,7 +1071,7 @@ err_out_ha_free: err_out_free: kfree(SHOST_TO_SAS_HA(shost)); err_out_free_host: - kfree(shost); + scsi_host_put(shost); err_out_regions: pci_release_regions(pdev); err_out_disable: @@ -1112,6 +1110,7 @@ static void pm8001_pci_remove(struct pci_dev *pdev) for (j = 0; j < PM8001_MAX_MSIX_VEC; j++) tasklet_kill(&pm8001_ha->tasklet[j]); #endif + scsi_host_put(pm8001_ha->shost); pm8001_free(pm8001_ha); kfree(sha->sas_phy); kfree(sha->sas_port); |