Commit d3d61f9c authored by Tomas Henzl's avatar Tomas Henzl Committed by Martin K. Petersen

scsi: mpi3mr: Fix a double free

Fix a double free, scsi_tgt_priv_data will be freed in
mpi3mr_target_destroy() so remove the kfree() from mpi3mr_target_alloc().
I've also removed few unneeded initialisations.

Link: https://lore.kernel.org/r/20210608145712.16386-1-thenzl@redhat.comAcked-by: default avatarKashyap Desai <kashyap.desai@broadcom.com>
Signed-off-by: default avatarTomas Henzl <thenzl@redhat.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent eb783bb8
...@@ -3295,13 +3295,10 @@ static int mpi3mr_target_alloc(struct scsi_target *starget) ...@@ -3295,13 +3295,10 @@ static int mpi3mr_target_alloc(struct scsi_target *starget)
return -ENOMEM; return -ENOMEM;
starget->hostdata = scsi_tgt_priv_data; starget->hostdata = scsi_tgt_priv_data;
scsi_tgt_priv_data->starget = starget;
scsi_tgt_priv_data->dev_handle = MPI3MR_INVALID_DEV_HANDLE;
spin_lock_irqsave(&mrioc->tgtdev_lock, flags); spin_lock_irqsave(&mrioc->tgtdev_lock, flags);
tgt_dev = __mpi3mr_get_tgtdev_by_perst_id(mrioc, starget->id); tgt_dev = __mpi3mr_get_tgtdev_by_perst_id(mrioc, starget->id);
if (tgt_dev && !tgt_dev->is_hidden) { if (tgt_dev && !tgt_dev->is_hidden) {
starget->hostdata = scsi_tgt_priv_data;
scsi_tgt_priv_data->starget = starget; scsi_tgt_priv_data->starget = starget;
scsi_tgt_priv_data->dev_handle = tgt_dev->dev_handle; scsi_tgt_priv_data->dev_handle = tgt_dev->dev_handle;
scsi_tgt_priv_data->perst_id = tgt_dev->perst_id; scsi_tgt_priv_data->perst_id = tgt_dev->perst_id;
...@@ -3310,10 +3307,8 @@ static int mpi3mr_target_alloc(struct scsi_target *starget) ...@@ -3310,10 +3307,8 @@ static int mpi3mr_target_alloc(struct scsi_target *starget)
tgt_dev->starget = starget; tgt_dev->starget = starget;
atomic_set(&scsi_tgt_priv_data->block_io, 0); atomic_set(&scsi_tgt_priv_data->block_io, 0);
retval = 0; retval = 0;
} else { } else
kfree(scsi_tgt_priv_data);
retval = -ENXIO; retval = -ENXIO;
}
spin_unlock_irqrestore(&mrioc->tgtdev_lock, flags); spin_unlock_irqrestore(&mrioc->tgtdev_lock, flags);
return retval; return retval;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment