Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a351e40b authored by Varun Prakash's avatar Varun Prakash Committed by Martin K. Petersen
Browse files

scsi: csiostor: fix use after free in csio_hw_use_fwconfig() 



mbp pointer is passed to csio_hw_validate_caps() so call mempool_free()
after calling csio_hw_validate_caps().

Signed-off-by: default avatarVarun Prakash <varun@chelsio.com>
Fixes: 541c571f ("csiostor:Use firmware version from cxgb4/t4fw_version.h")
Reviewed-by: default avatarJohannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent 463f620b

drivers/scsi/csiostor/csio_hw.c

+4 −1
Original line number Diff line number Diff line
@@ -1769,7 +1769,6 @@ csio_hw_use_fwconfig(struct csio_hw *hw, int reset, u32 *fw_cfg_param) 
		goto bye;

	}



	mempool_free(mbp, hw->mb_mempool);

	if (finicsum != cfcsum) {

		csio_warn(hw,

		      "Config File checksum mismatch: csum=%#x, computed=%#x\n",
@@ -1780,6 +1779,10 @@ csio_hw_use_fwconfig(struct csio_hw *hw, int reset, u32 *fw_cfg_param) 
	rv = csio_hw_validate_caps(hw, mbp);

	if (rv != 0)

		goto bye;



	mempool_free(mbp, hw->mb_mempool);

	mbp = NULL;



	/*

	 * Note that we're operating with parameters

	 * not supplied by the driver, rather than from hard-wired