Commit 19099dc3 authored Dec 16, 2016 by Dan Carpenter Committed by Martin K. Petersen Jan 05, 2017

scsi: dpt_i2o: double free if adpt_i2o_online_hba() fails

There are two places where adpt_i2o_online_hba() is called. Both
callers call adpt_i2o_delete_hba(pHba) if adpt_i2o_online_hba() fails
and since we also free it here that causes a double free bug.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

parent e0075478

drivers/scsi/dpt_i2o.c

+2 −6

Original line number	Diff line number	Diff line
		@@ -2768,16 +2768,12 @@ static int adpt_i2o_activate_hba(adpt_hba* pHba)

		static int adpt_i2o_online_hba(adpt_hba* pHba)
		{
		if (adpt_i2o_systab_send(pHba) < 0) {
		adpt_i2o_delete_hba(pHba);
		if (adpt_i2o_systab_send(pHba) < 0)
		return -1;
		}
		/* In READY state */

		if (adpt_i2o_enable_hba(pHba) < 0) {
		adpt_i2o_delete_hba(pHba);
		if (adpt_i2o_enable_hba(pHba) < 0)
		return -1;
		}

		/* In OPERATIONAL state */
		return 0;