Merge "Prevent potential double frees in sg driver" (5692252e) · Commits · e / devices / android_kernel_fairphone_FP3

drivers/scsi/sg.c

+19 −14

Original line number	Diff line number	Diff line
		@@ -859,8 +859,10 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
		return -ENXIO;
		if (!access_ok(VERIFY_WRITE, p, SZ_SG_IO_HDR))
		return -EFAULT;
		mutex_lock(&sfp->parentdp->open_rel_lock);
		result = sg_new_write(sfp, filp, p, SZ_SG_IO_HDR,
		1, read_only, 1, &srp);
		mutex_unlock(&sfp->parentdp->open_rel_lock);
		if (result < 0)
		return result;
		result = wait_event_interruptible(sfp->read_wait,
		@@ -901,8 +903,10 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
		sfp->low_dma = 1;
		if ((0 == sfp->low_dma) && !sfp->res_in_use) {
		val = (int) sfp->reserve.bufflen;
		mutex_lock(&sfp->parentdp->open_rel_lock);
		sg_remove_scat(sfp, &sfp->reserve);
		sg_build_reserve(sfp, val);
		mutex_unlock(&sfp->parentdp->open_rel_lock);
		}
		} else {
		if (atomic_read(&sdp->detaching))
		@@ -981,9 +985,10 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
		mutex_unlock(&sfp->f_mutex);
		return -EBUSY;
		}

		mutex_lock(&sfp->parentdp->open_rel_lock);
		sg_remove_scat(sfp, &sfp->reserve);
		sg_build_reserve(sfp, val);
		mutex_unlock(&sfp->parentdp->open_rel_lock);
		}
		mutex_unlock(&sfp->f_mutex);
		return 0;