Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
tjh.dev
kernel
os
linux
scsi: dpt_i2o: Use after free in I2ORESETCMD ioctl
Here is another use after free if we reset the card. The adpt_hba_reset()
function frees "pHba" on error.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
authored by Dan Carpenter and committed by Martin K. Petersen 7709e9bd f4abab3f
+8
-5
drivers/scsi/dpt_i2o.c
+8
-5
drivers/scsi/dpt_i2o.c
···
2051
}
2052
break;
2053
}
2054
-
case I2ORESETCMD:
2055
-
if(pHba->host)
2056
-
spin_lock_irqsave(pHba->host->host_lock, flags);
2057
adpt_hba_reset(pHba);
2058
-
if(pHba->host)
2059
-
spin_unlock_irqrestore(pHba->host->host_lock, flags);
2060
break;
2061
case I2ORESCANCMD:
2062
adpt_rescan(pHba);
2063
break;
···
2051
}
2052
break;
2053
}
2054
+
case I2ORESETCMD: {
2055
+
struct Scsi_Host *shost = pHba->host;
2056
+
2057
+
if (shost)
2058
+
spin_lock_irqsave(shost->host_lock, flags);
2059
adpt_hba_reset(pHba);
2060
+
if (shost)
2061
+
spin_unlock_irqrestore(shost->host_lock, flags);
2062
break;
2063
+
}
2064
case I2ORESCANCMD:
2065
adpt_rescan(pHba);
2066
break;