Re: [patch] scsi: dpt_i2o: double free if adpt_i2o_online_hba() fails

[Martin K. Petersen]

> "Dan" == Dan Carpenter  writes:

Dan> There are two places where adpt_i2o_online_hba() is called.  Both
Dan> callers call adpt_i2o_delete_hba(pHba) if adpt_i2o_online_hba()
Dan> fails and since we also free it here that causes a double free bug.

Applied to 4.11/scsi-queue.

-- 
Martin K. Petersen  Oracle Linux Engineering
--
To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[patch] scsi: dpt_i2o: double free if adpt_i2o_online_hba() fails

[Dan Carpenter]

There are two places where adpt_i2o_online_hba() is called.  Both
callers call adpt_i2o_delete_hba(pHba) if adpt_i2o_online_hba() fails
and since we also free it here that causes a double free bug.

Signed-off-by: Dan Carpenter 
---
This bug pre-dates git.

diff --git a/drivers/scsi/dpt_i2o.c b/drivers/scsi/dpt_i2o.c
index 27c0dce22e72..7d32c2f07067 100644
--- a/drivers/scsi/dpt_i2o.c
+++ b/drivers/scsi/dpt_i2o.c
@@ -2768,16 +2768,12 @@ static int adpt_i2o_activate_hba(adpt_hba* pHba)
  
 static int adpt_i2o_online_hba(adpt_hba* pHba)
 {
-   if (adpt_i2o_systab_send(pHba) < 0) {
-   adpt_i2o_delete_hba(pHba);
+   if (adpt_i2o_systab_send(pHba) < 0)
return -1;
-   }
/* In READY state */
 
-   if (adpt_i2o_enable_hba(pHba) < 0) {
-   adpt_i2o_delete_hba(pHba);
+   if (adpt_i2o_enable_hba(pHba) < 0)
return -1;
-   }
 
/* In OPERATIONAL state  */
return 0;
--
To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html