* scsi: pm8001: fix double free in pm8001_pci_probe
@ 2017-08-08 11:40 Pan Bian
2017-08-08 13:10 ` Jinpu Wang
2017-08-11 0:05 ` Martin K. Petersen
0 siblings, 2 replies; 3+ messages in thread
From: Pan Bian @ 2017-08-08 11:40 UTC (permalink / raw)
To: Jack Wang, lindar_liu, James E.J. Bottomley, Martin K. Petersen
Cc: linux-scsi, linux-kernel, Pan Bian
In function pm8001_pci_probe(), on errors that the control flow jumps to
label err_out_ha_free, function pm8001_free() is called. In pm8001_free(),
scsi_host_put() is called to release shost, which keeps the return value
of scsi_host_alloc(). After pm8001_free() returns, kfree() is called to
free shost again, resulting in a double free bug. This patch removes
scsi_host_put() from pm8001_free() and explicitly calls scsi_host_put()
to release Scsi_Host in need.
Signed-off-by: Pan Bian <bianpan2016@163.com>
---
drivers/scsi/pm8001/pm8001_init.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/scsi/pm8001/pm8001_init.c b/drivers/scsi/pm8001/pm8001_init.c
index 034b2f7..2908881 100644
--- a/drivers/scsi/pm8001/pm8001_init.c
+++ b/drivers/scsi/pm8001/pm8001_init.c
@@ -160,8 +160,6 @@ static void pm8001_free(struct pm8001_hba_info *pm8001_ha)
}
}
PM8001_CHIP_DISP->chip_iounmap(pm8001_ha);
- if (pm8001_ha->shost)
- scsi_host_put(pm8001_ha->shost);
flush_workqueue(pm8001_wq);
kfree(pm8001_ha->tags);
kfree(pm8001_ha);
@@ -1073,7 +1071,7 @@ static int pm8001_pci_probe(struct pci_dev *pdev,
err_out_free:
kfree(SHOST_TO_SAS_HA(shost));
err_out_free_host:
- kfree(shost);
+ scsi_host_put(shost);
err_out_regions:
pci_release_regions(pdev);
err_out_disable:
@@ -1112,6 +1110,7 @@ static void pm8001_pci_remove(struct pci_dev *pdev)
for (j = 0; j < PM8001_MAX_MSIX_VEC; j++)
tasklet_kill(&pm8001_ha->tasklet[j]);
#endif
+ scsi_host_put(pm8001_ha->shost);
pm8001_free(pm8001_ha);
kfree(sha->sas_phy);
kfree(sha->sas_port);
--
1.9.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: scsi: pm8001: fix double free in pm8001_pci_probe
2017-08-08 11:40 scsi: pm8001: fix double free in pm8001_pci_probe Pan Bian
@ 2017-08-08 13:10 ` Jinpu Wang
2017-08-11 0:05 ` Martin K. Petersen
1 sibling, 0 replies; 3+ messages in thread
From: Jinpu Wang @ 2017-08-08 13:10 UTC (permalink / raw)
To: Pan Bian
Cc: lindar_liu, James E.J. Bottomley, Martin K. Petersen,
Linux SCSI Mailinglist, linux-kernel
On Tue, Aug 8, 2017 at 1:40 PM, Pan Bian <bianpan2016@163.com> wrote:
> In function pm8001_pci_probe(), on errors that the control flow jumps to
> label err_out_ha_free, function pm8001_free() is called. In pm8001_free(),
> scsi_host_put() is called to release shost, which keeps the return value
> of scsi_host_alloc(). After pm8001_free() returns, kfree() is called to
> free shost again, resulting in a double free bug. This patch removes
> scsi_host_put() from pm8001_free() and explicitly calls scsi_host_put()
> to release Scsi_Host in need.
>
> Signed-off-by: Pan Bian <bianpan2016@163.com>
Thanks Pan!
Looks good to me!
Reviewed-by: Jack Wang <jinpu.wang@profitbricks.com>
> ---
> drivers/scsi/pm8001/pm8001_init.c | 5 ++---
> 1 file changed, 2 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/scsi/pm8001/pm8001_init.c b/drivers/scsi/pm8001/pm8001_init.c
> index 034b2f7..2908881 100644
> --- a/drivers/scsi/pm8001/pm8001_init.c
> +++ b/drivers/scsi/pm8001/pm8001_init.c
> @@ -160,8 +160,6 @@ static void pm8001_free(struct pm8001_hba_info *pm8001_ha)
> }
> }
> PM8001_CHIP_DISP->chip_iounmap(pm8001_ha);
> - if (pm8001_ha->shost)
> - scsi_host_put(pm8001_ha->shost);
> flush_workqueue(pm8001_wq);
> kfree(pm8001_ha->tags);
> kfree(pm8001_ha);
> @@ -1073,7 +1071,7 @@ static int pm8001_pci_probe(struct pci_dev *pdev,
> err_out_free:
> kfree(SHOST_TO_SAS_HA(shost));
> err_out_free_host:
> - kfree(shost);
> + scsi_host_put(shost);
> err_out_regions:
> pci_release_regions(pdev);
> err_out_disable:
> @@ -1112,6 +1110,7 @@ static void pm8001_pci_remove(struct pci_dev *pdev)
> for (j = 0; j < PM8001_MAX_MSIX_VEC; j++)
> tasklet_kill(&pm8001_ha->tasklet[j]);
> #endif
> + scsi_host_put(pm8001_ha->shost);
> pm8001_free(pm8001_ha);
> kfree(sha->sas_phy);
> kfree(sha->sas_port);
> --
> 1.9.1
>
>
--
Jack Wang
Linux Kernel Developer
ProfitBricks GmbH
Greifswalder Str. 207
D - 10405 Berlin
Tel: +49 30 577 008 042
Fax: +49 30 577 008 299
Email: jinpu.wang@profitbricks.com
URL: https://www.profitbricks.de
Sitz der Gesellschaft: Berlin
Registergericht: Amtsgericht Charlottenburg, HRB 125506 B
Geschäftsführer: Achim Weiss
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: scsi: pm8001: fix double free in pm8001_pci_probe
2017-08-08 11:40 scsi: pm8001: fix double free in pm8001_pci_probe Pan Bian
2017-08-08 13:10 ` Jinpu Wang
@ 2017-08-11 0:05 ` Martin K. Petersen
1 sibling, 0 replies; 3+ messages in thread
From: Martin K. Petersen @ 2017-08-11 0:05 UTC (permalink / raw)
To: Pan Bian
Cc: Jack Wang, lindar_liu, James E.J. Bottomley, Martin K. Petersen,
linux-scsi, linux-kernel
Pan,
> In function pm8001_pci_probe(), on errors that the control flow jumps to
> label err_out_ha_free, function pm8001_free() is called. In pm8001_free(),
> scsi_host_put() is called to release shost, which keeps the return value
> of scsi_host_alloc(). After pm8001_free() returns, kfree() is called to
> free shost again, resulting in a double free bug. This patch removes
> scsi_host_put() from pm8001_free() and explicitly calls scsi_host_put()
> to release Scsi_Host in need.
Applied to 4.14/scsi-queue.
--
Martin K. Petersen Oracle Linux Engineering
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-08-11 0:06 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-08-08 11:40 scsi: pm8001: fix double free in pm8001_pci_probe Pan Bian
2017-08-08 13:10 ` Jinpu Wang
2017-08-11 0:05 ` Martin K. Petersen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).