* Re: [PATCH] scsi: dpt_i2o: Use after free in I2ORESETCMD ioctl
@ 2018-04-10 2:06 Martin K. Petersen
0 siblings, 0 replies; 2+ messages in thread
From: Martin K. Petersen @ 2018-04-10 2:06 UTC (permalink / raw)
To: kernel-janitors
Dan,
> Here is another use after free if we reset the card. The adpt_hba_reset()
> function frees "pHba" on error.
Applied to 4.17/scsi-fixes. Thank you!
--
Martin K. Petersen Oracle Linux Engineering
^ permalink raw reply [flat|nested] 2+ messages in thread
* [PATCH] scsi: dpt_i2o: Use after free in I2ORESETCMD ioctl
@ 2018-03-21 8:09 Dan Carpenter
0 siblings, 0 replies; 2+ messages in thread
From: Dan Carpenter @ 2018-03-21 8:09 UTC (permalink / raw)
To: kernel-janitors
Here is another use after free if we reset the card. The adpt_hba_reset()
function frees "pHba" on error.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/scsi/dpt_i2o.c b/drivers/scsi/dpt_i2o.c
index 3c667b23a801..359e0acfbc7c 100644
--- a/drivers/scsi/dpt_i2o.c
+++ b/drivers/scsi/dpt_i2o.c
@@ -2046,13 +2046,16 @@ static int adpt_ioctl(struct inode *inode, struct file *file, uint cmd, ulong ar
}
break;
}
- case I2ORESETCMD:
- if(pHba->host)
- spin_lock_irqsave(pHba->host->host_lock, flags);
+ case I2ORESETCMD: {
+ struct Scsi_Host *shost = pHba->host;
+
+ if (shost)
+ spin_lock_irqsave(shost->host_lock, flags);
adpt_hba_reset(pHba);
- if(pHba->host)
- spin_unlock_irqrestore(pHba->host->host_lock, flags);
+ if (shost)
+ spin_unlock_irqrestore(shost->host_lock, flags);
break;
+ }
case I2ORESCANCMD:
adpt_rescan(pHba);
break;
^ permalink raw reply related [flat|nested] 2+ messages in thread
end of thread, other threads:[~2018-04-10 2:06 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-04-10 2:06 [PATCH] scsi: dpt_i2o: Use after free in I2ORESETCMD ioctl Martin K. Petersen
-- strict thread matches above, loose matches on Subject: below --
2018-03-21 8:09 Dan Carpenter
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.