redonkable/remarkable-linux
redonkable/remarkable-linux
1
0
Fork 0
Code Releases Activity

scsi: dpt_i2o: Use after free in I2ORESETCMD ioctl

Browse source 
Here is another use after free if we reset the card.  The adpt_hba_reset()
function frees "pHba" on error.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
This commit is contained in:
Dan Carpenter 2018-03-21 11:09:42 +03:00 committed by Martin K. Petersen
parent f4abab3f18
commit 7709e9bdee
1 changed files with 8 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
drivers/scsi/dpt_i2o.c
View file

@ -2051,13 +2051,16 @@ static int adpt_ioctl(struct inode *inode, struct file *file, uint cmd, ulong ar
}
break;
}
case I2ORESETCMD:
if(pHba->host)
spin_lock_irqsave(pHba->host->host_lock, flags);
case I2ORESETCMD: {
struct Scsi_Host *shost = pHba->host;
if (shost)
spin_lock_irqsave(shost->host_lock, flags);
adpt_hba_reset(pHba);
if(pHba->host)
spin_unlock_irqrestore(pHba->host->host_lock, flags);
if (shost)
spin_unlock_irqrestore(shost->host_lock, flags);
break;
}
case I2ORESCANCMD:
adpt_rescan(pHba);
break;