redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

scsi: dpt_i2o: use after free in __adpt_reset() 

In __adpt_reset() the problem is that adpt_hba_reset() frees "pHba" on
error but we dereference it to print the name in the error message.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
hifive-unleashed-5.1
Dan Carpenter 2018-03-19 13:34:01 +03:00 committed by Martin K. Petersen
parent 24268fd1ad
commit 10ff6be6de
1 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
drivers/scsi/dpt_i2o.c
View File

@ -799,14 +799,17 @@ static int __adpt_reset(struct scsi_cmnd* cmd)
{
adpt_hba* pHba;
int rcode;
char name[32];
pHba = (adpt_hba*)cmd->device->host->hostdata[0];
printk(KERN_WARNING"%s: Hba Reset: scsi id %d: tid: %d\n",pHba->name,cmd->device->channel,pHba->channel[cmd->device->channel].tid );
strncpy(name, pHba->name, sizeof(name));
printk(KERN_WARNING"%s: Hba Reset: scsi id %d: tid: %d\n", name, cmd->device->channel, pHba->channel[cmd->device->channel].tid);
rcode = adpt_hba_reset(pHba);
if(rcode == 0){
printk(KERN_WARNING"%s: HBA reset complete\n",pHba->name);
printk(KERN_WARNING"%s: HBA reset complete\n", name);
return SUCCESS;
} else {
printk(KERN_WARNING"%s: HBA reset failed (%x)\n",pHba->name, rcode);
printk(KERN_WARNING"%s: HBA reset failed (%x)\n", name, rcode);
return FAILED;
}
}