Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ea17f797 authored by qctecmdr's avatar qctecmdr Committed by Gerrit - the friendly Code Review server
Browse files

Merge "Prevent potential double frees in sg driver"

parents b66b3559 2da2551b

drivers/scsi/sg.c

+13 −10
Original line number Diff line number Diff line
@@ -928,8 +928,10 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg) 
			return -ENXIO;

		if (!access_ok(VERIFY_WRITE, p, SZ_SG_IO_HDR))

			return -EFAULT;

		mutex_lock(&sfp->parentdp->open_rel_lock);

		result = sg_new_write(sfp, filp, p, SZ_SG_IO_HDR,

				 1, read_only, 1, &srp);

		mutex_unlock(&sfp->parentdp->open_rel_lock);

		if (result < 0)

			return result;

		result = wait_event_interruptible(sfp->read_wait,
@@ -1041,9 +1043,10 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg) 
				mutex_unlock(&sfp->f_mutex);

				return -EBUSY;

			}



			mutex_lock(&sfp->parentdp->open_rel_lock);

			sg_remove_scat(sfp, &sfp->reserve);

			sg_build_reserve(sfp, val);

			mutex_unlock(&sfp->parentdp->open_rel_lock);

		}

		mutex_unlock(&sfp->f_mutex);

		return 0;