Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

scsi: dpt_i2o: Use after free in I2ORESETCMD ioctl

Browse source 
Here is another use after free if we reset the card.  The adpt_hba_reset()
function frees "pHba" on error.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
This commit is contained in:
Dan Carpenter 2018-03-21 11:09:42 +03:00 • committed by Martin K. Petersen
parent f4abab3f18
commit 7709e9bdee
1 changed files with 8 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
drivers/scsi/dpt_i2o.c
View file

@ -2051,13 +2051,16 @@ static int adpt_ioctl(struct inode *inode, struct file *file, uint cmd, ulong ar
} }
break; break;
} }
case I2ORESETCMD: case I2ORESETCMD: {
if(pHba->host) struct Scsi_Host *shost = pHba->host;
spin_lock_irqsave(pHba->host->host_lock, flags);
if (shost)
spin_lock_irqsave(shost->host_lock, flags);
adpt_hba_reset(pHba); adpt_hba_reset(pHba);
if(pHba->host) if (shost)
spin_unlock_irqrestore(pHba->host->host_lock, flags); spin_unlock_irqrestore(shost->host_lock, flags);
break; break;
}
case I2ORESCANCMD: case I2ORESCANCMD:
adpt_rescan(pHba); adpt_rescan(pHba);
break; break;