Re: scsi: pm8001: fix double free in pm8001_pci_probe

From	"Martin K. Petersen" <martin.petersen@oracle.com>
Newsgroups	linux.kernel
Subject	Re: scsi: pm8001: fix double free in pm8001_pci_probe
Date	2017-08-11 02:10 +0200
Message-ID	<ud5Gy-4IP-11@gated-at.bofh.it> (permalink)
References	<ucbbj-7PZ-5@gated-at.bofh.it>
Organization	Oracle Corporation

Show all headers | View raw

Pan,

> In function pm8001_pci_probe(), on errors that the control flow jumps to
> label err_out_ha_free, function pm8001_free() is called. In pm8001_free(),
> scsi_host_put() is called to release shost, which keeps the return value
> of scsi_host_alloc(). After pm8001_free() returns, kfree() is called to
> free shost again, resulting in a double free bug. This patch removes
> scsi_host_put() from pm8001_free() and explicitly calls scsi_host_put()
> to release Scsi_Host in need.

Applied to 4.14/scsi-queue.

-- 
Martin K. Petersen	Oracle Linux Engineering

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

scsi: pm8001: fix double free in pm8001_pci_probe Pan Bian <bianpan2016@163.com> - 2017-08-08 13:50 +0200
  Re: scsi: pm8001: fix double free in pm8001_pci_probe Jinpu Wang <jinpu.wang@profitbricks.com> - 2017-08-08 15:20 +0200
  Re: scsi: pm8001: fix double free in pm8001_pci_probe "Martin K. Petersen" <martin.petersen@oracle.com> - 2017-08-11 02:10 +0200

csiph-web