Commit bc1371c1 authored by Pan Bian's avatar Pan Bian Committed by Martin K. Petersen

scsi: pm8001: fix double free in pm8001_pci_probe

In function pm8001_pci_probe(), on errors that the control flow jumps to
label err_out_ha_free, function pm8001_free() is called. In pm8001_free(),
scsi_host_put() is called to release shost, which keeps the return value
of scsi_host_alloc(). After pm8001_free() returns, kfree() is called to
free shost again, resulting in a double free bug. This patch removes
scsi_host_put() from pm8001_free() and explicitly calls scsi_host_put()
to release Scsi_Host in need.
Signed-off-by: default avatarPan Bian <bianpan2016@163.com>
Reviewed-by: default avatarJack Wang <jinpu.wang@profitbricks.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent 3b8328e2
...@@ -160,8 +160,6 @@ static void pm8001_free(struct pm8001_hba_info *pm8001_ha) ...@@ -160,8 +160,6 @@ static void pm8001_free(struct pm8001_hba_info *pm8001_ha)
} }
} }
PM8001_CHIP_DISP->chip_iounmap(pm8001_ha); PM8001_CHIP_DISP->chip_iounmap(pm8001_ha);
if (pm8001_ha->shost)
scsi_host_put(pm8001_ha->shost);
flush_workqueue(pm8001_wq); flush_workqueue(pm8001_wq);
kfree(pm8001_ha->tags); kfree(pm8001_ha->tags);
kfree(pm8001_ha); kfree(pm8001_ha);
...@@ -1073,7 +1071,7 @@ static int pm8001_pci_probe(struct pci_dev *pdev, ...@@ -1073,7 +1071,7 @@ static int pm8001_pci_probe(struct pci_dev *pdev,
err_out_free: err_out_free:
kfree(SHOST_TO_SAS_HA(shost)); kfree(SHOST_TO_SAS_HA(shost));
err_out_free_host: err_out_free_host:
kfree(shost); scsi_host_put(shost);
err_out_regions: err_out_regions:
pci_release_regions(pdev); pci_release_regions(pdev);
err_out_disable: err_out_disable:
...@@ -1112,6 +1110,7 @@ static void pm8001_pci_remove(struct pci_dev *pdev) ...@@ -1112,6 +1110,7 @@ static void pm8001_pci_remove(struct pci_dev *pdev)
for (j = 0; j < PM8001_MAX_MSIX_VEC; j++) for (j = 0; j < PM8001_MAX_MSIX_VEC; j++)
tasklet_kill(&pm8001_ha->tasklet[j]); tasklet_kill(&pm8001_ha->tasklet[j]);
#endif #endif
scsi_host_put(pm8001_ha->shost);
pm8001_free(pm8001_ha); pm8001_free(pm8001_ha);
kfree(sha->sas_phy); kfree(sha->sas_phy);
kfree(sha->sas_port); kfree(sha->sas_port);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment