scsi: dpt_i2o: Use after free in I2ORESETCMD ioctl
Here is another use after free if we reset the card. The adpt_hba_reset() function frees "pHba" on error. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
This commit is contained in:
parent
f4abab3f18
commit
7709e9bdee
|
@ -2051,13 +2051,16 @@ static int adpt_ioctl(struct inode *inode, struct file *file, uint cmd, ulong ar
|
|||
}
|
||||
break;
|
||||
}
|
||||
case I2ORESETCMD:
|
||||
if(pHba->host)
|
||||
spin_lock_irqsave(pHba->host->host_lock, flags);
|
||||
case I2ORESETCMD: {
|
||||
struct Scsi_Host *shost = pHba->host;
|
||||
|
||||
if (shost)
|
||||
spin_lock_irqsave(shost->host_lock, flags);
|
||||
adpt_hba_reset(pHba);
|
||||
if(pHba->host)
|
||||
spin_unlock_irqrestore(pHba->host->host_lock, flags);
|
||||
if (shost)
|
||||
spin_unlock_irqrestore(shost->host_lock, flags);
|
||||
break;
|
||||
}
|
||||
case I2ORESCANCMD:
|
||||
adpt_rescan(pHba);
|
||||
break;
|
||||
|
|
Loading…
Reference in a new issue