[patch] scsi: dpt_i2o: double free on error path

[patch] scsi: dpt_i2o: double free on error path

[Dan Carpenter]

We recently introduced a kfree() in the caller for this function.
That's where, logically, you would think the kfree() should be.
Unfortunately the code was just ugly and not buggy so the static
checker warning was a false postive and introduced a double free.

I've removed the old kfree() and left the new one.

Fixes: 021e2927586d ("scsi: dpt_i2o: Add a missing call to kfree")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

diff --git a/drivers/scsi/dpt_i2o.c b/drivers/scsi/dpt_i2o.c
index f88b3d2..27c0dce 100644
--- a/drivers/scsi/dpt_i2o.c
+++ b/drivers/scsi/dpt_i2o.c
@@ -651,7 +651,6 @@ static u32 adpt_ioctl_to_context(adpt_hba * pHba, void *reply)
 	}
 	spin_unlock_irqrestore(pHba->host->host_lock, flags);
 	if (i >= nr) {
-		kfree (reply);
 		printk(KERN_WARNING"%s: Too many outstanding "
 				"ioctl commands\n", pHba->name);
 		return (u32)-1;

[patch] scsi: dpt_i2o: double free on error path

[Dan Carpenter]

We recently introduced a kfree() in the caller for this function.
That's where, logically, you would think the kfree() should be.
Unfortunately the code was just ugly and not buggy so the static
checker warning was a false postive and introduced a double free.

I've removed the old kfree() and left the new one.

Fixes: 021e2927586d ("scsi: dpt_i2o: Add a missing call to kfree")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

diff --git a/drivers/scsi/dpt_i2o.c b/drivers/scsi/dpt_i2o.c
index f88b3d2..27c0dce 100644
--- a/drivers/scsi/dpt_i2o.c
+++ b/drivers/scsi/dpt_i2o.c
@@ -651,7 +651,6 @@ static u32 adpt_ioctl_to_context(adpt_hba * pHba, void *reply)
 	}
 	spin_unlock_irqrestore(pHba->host->host_lock, flags);
 	if (i >= nr) {
-		kfree (reply);
 		printk(KERN_WARNING"%s: Too many outstanding "
 				"ioctl commands\n", pHba->name);
 		return (u32)-1;

Re: [patch] scsi: dpt_i2o: double free on error path

[Quentin Lambert]

On 11/30/2016 08:36 PM, Dan Carpenter wrote:
> We recently introduced a kfree() in the caller for this function.
> That's where, logically, you would think the kfree() should be.
> Unfortunately the code was just ugly and not buggy so the static
> checker warning was a false postive and introduced a double free.
>
oh, yes! Sorry I missed that.

Quentin

Re: [patch] scsi: dpt_i2o: double free on error path

[Quentin Lambert]

On 11/30/2016 08:36 PM, Dan Carpenter wrote:
> We recently introduced a kfree() in the caller for this function.
> That's where, logically, you would think the kfree() should be.
> Unfortunately the code was just ugly and not buggy so the static
> checker warning was a false postive and introduced a double free.
>
oh, yes! Sorry I missed that.

Quentin

Re: [patch] scsi: dpt_i2o: double free on error path

[Martin K. Petersen]

>>>>> "Dan" = Dan Carpenter <dan.carpenter@oracle.com> writes:

Dan> We recently introduced a kfree() in the caller for this function.
Dan> That's where, logically, you would think the kfree() should be.
Dan> Unfortunately the code was just ugly and not buggy so the static
Dan> checker warning was a false postive and introduced a double free.

Dan> I've removed the old kfree() and left the new one.

Applied to 4.10/scsi-queue.

-- 
Martin K. Petersen	Oracle Linux Engineering

Re: [patch] scsi: dpt_i2o: double free on error path

[Martin K. Petersen]

>>>>> "Dan" == Dan Carpenter <dan.carpenter@oracle.com> writes:

Dan> We recently introduced a kfree() in the caller for this function.
Dan> That's where, logically, you would think the kfree() should be.
Dan> Unfortunately the code was just ugly and not buggy so the static
Dan> checker warning was a false postive and introduced a double free.

Dan> I've removed the old kfree() and left the new one.

Applied to 4.10/scsi-queue.

-- 
Martin K. Petersen	Oracle Linux Engineering